@tishlang/tish-lsp 2.39.0 → 3.0.0

package/crates/tish_vm/src/jit.rs

@@ -55,6 +55,12 @@ pub struct LoopFn {
     /// region). The region always has ≥1 exit (an exit-less region would be an uninterruptible native
     /// loop, so compilation bails).
     pub exits: Vec<usize>,
+    /// #203 — array live-in slots `(chunk slot, writable)` in marshalling order (ascending slot). EMPTY
+    /// ⇒ the pure-numeric 2-pointer ABI `(slots, deopt)` (unchanged). NON-EMPTY ⇒ the 3-pointer array
+    /// ABI `(slots, handles, deopt)`: `run_osr` extracts each array live-in to a scratch `Vec<f64>`,
+    /// passes it as an [`ArrayHandle`], and (for a `writable` slot) copies the scratch back into the
+    /// caller's `Value::Array` — ONLY on a clean, non-deopt exit.
+    pub array_slots: Vec<(u16, bool)>,
 }
 
 // SAFETY: identical to `NumericFn` — `ptr` is immutable executable code in the process-global,
@@ -64,17 +70,27 @@ unsafe impl Send for LoopFn {}
 unsafe impl Sync for LoopFn {}
 
 impl LoopFn {
-    /// Run the region. `buf` holds the live-ins (`used_slots.len()` `f64`s), updated in place with the
-    /// live-outs on return. `deopt` is a 1-byte flag (unused in v1). Returns the exit id. Safe wrapper
-    /// — the raw-pointer transmute (same soundness as [`NumericFn::call`]: immutable native code with a
-    /// fixed C ABI) is confined here, so call sites need no `unsafe`.
+    /// Run the region. `buf` holds the numeric live-ins (`used_slots.len()` `f64`s), updated in place
+    /// with the live-outs on return. `handles` holds the array live-ins (`array_slots.len()`
+    /// [`ArrayHandle`]s, in `array_slots` order) — empty for a pure-numeric region. `deopt` is a
+    /// 1-byte flag the region sets on an int-slot live-in miss (#514) or an out-of-bounds array index
+    /// (#203); on `deopt != 0` the caller discards `buf` AND the scratch behind `handles` and
+    /// re-interprets. Returns the exit id. Safe wrapper — the raw-pointer transmute (same soundness as
+    /// [`NumericFn::call`]: immutable native code with a fixed C ABI) is confined here.
     #[inline]
-    pub fn call(&self, buf: &mut [f64], deopt: &mut u8) -> i32 {
-        // SAFETY: `ptr` is immutable executable code compiled for exactly this `(*mut f64, *mut u8)`
-        // ABI; `buf`/`deopt` are valid for the call and the region only touches `buf[0..used_slots]`.
+    pub fn call(&self, buf: &mut [f64], handles: &mut [ArrayHandle], deopt: &mut u8) -> i32 {
+        // SAFETY: `ptr` is immutable executable code compiled for exactly this ABI (2-pointer when
+        // `array_slots` is empty, else 3-pointer); `buf`/`handles`/`deopt` are valid for the call and
+        // the region only touches `buf[0..used_slots]` + the handles' backing scratch.
         unsafe {
-            let f: extern "C" fn(*mut f64, *mut u8) -> i32 = std::mem::transmute(self.ptr);
-            f(buf.as_mut_ptr(), deopt as *mut u8)
+            if self.array_slots.is_empty() {
+                let f: extern "C" fn(*mut f64, *mut u8) -> i32 = std::mem::transmute(self.ptr);
+                f(buf.as_mut_ptr(), deopt as *mut u8)
+            } else {
+                let f: extern "C" fn(*mut f64, *mut ArrayHandle, *mut u8) -> i32 =
+                    std::mem::transmute(self.ptr);
+                f(buf.as_mut_ptr(), handles.as_mut_ptr(), deopt as *mut u8)
+            }
         }
     }
 }
@@ -180,6 +196,30 @@ pub fn jit_jv_enabled() -> bool {
     })
 }
 
+/// #203 — bounded array-index (`arr[i]` read / `arr[i] = v` write) inside an OSR loop **region**
+/// (the matmul lever). A hot loop that indexes a numeric `Value::Array` live-in (created BEFORE the
+/// region, e.g. matmul's `a`/`b`/`c`) is marshalled through the [`ArrayHandle`] inline ABI: each
+/// array live-in is extracted to a scratch `Vec<f64>` and passed as `(ptr,len)`; `GetIndex`/`SetIndex`
+/// lower to a bounds-checked native load/store over a COMPUTED index (`a[i*N+k]`), and writable arrays
+/// are copied back only on a clean (non-deopt) exit. Any out-of-bounds index sets the region deopt
+/// flag and the VM re-interprets from the pristine pre-region state (scratch discarded, real array
+/// untouched) — identical to the entry int-slot guard, so a mid-region bail never commits a partial
+/// result. Additive + bail-safe: a misclassified slot fails the runtime `Value::Array` marshalling
+/// check (→ interpret), and an unhandleable region shape is simply not compiled.
+///
+/// **Default ON** (validated: matmul 87×, zero perf regressions across the 29-fixture gauntlet, parity
+/// interp==vm==node, all six backends agree, adversarial review found + fixed the one bool-store bug);
+/// `TISH_JIT_OSR_ARRAY=0` disables it (escape hatch).
+#[cfg(not(target_arch = "wasm32"))]
+pub fn osr_array_enabled() -> bool {
+    static ENABLED: OnceLock<bool> = OnceLock::new();
+    *ENABLED.get_or_init(|| {
+        std::env::var("TISH_JIT_OSR_ARRAY")
+            .map(|v| v != "0")
+            .unwrap_or(true)
+    })
+}
+
 /// Boolean scalar local slots in the numeric CFG JIT (#187). **Default ON**; `TISH_JIT_BOOL_SLOTS=0`
 /// disables it. A `let flag = false` / `flag = true` / `if (flag)` local is represented as an `f64`
 /// `0.0`/`1.0`; a syntactic pre-pass ([`classify_bool_slots`]) tags the slots, and the equality
@@ -194,6 +234,26 @@ pub fn jit_bool_slots_enabled() -> bool {
     })
 }
 
+/// #168 int-typed slots. **Default ON**; `TISH_JIT_INT_SLOTS=0` disables (falls back to f64
+/// slots — the pre-#168 behavior, byte-identical results).
+///
+/// A local whose every store is a bitwise/shift result (or an integral constant) lives in an
+/// `i64` Variable holding the EXACT JS number ([`Repr::I64Num`]), so an integer hash/PRNG
+/// accumulator (`h = ((h << 13) | (h >>> 19)) >>> 0; h = h ^ …`) stays in integer registers
+/// ACROSS statements instead of paying an f64 materialize at every store plus a `ToInt32`
+/// re-derivation at every load. A syntactic pre-pass ([`classify_int_slots`]) tags the slots;
+/// the StoreLocal translator bails compilation on any store the pre-pass mis-tagged (a
+/// non-integer value reaching an int slot), so a wrong tag can never miscompile — it just
+/// runs the VM.
+pub fn jit_int_slots_enabled() -> bool {
+    static ENABLED: OnceLock<bool> = OnceLock::new();
+    *ENABLED.get_or_init(|| {
+        std::env::var("TISH_JIT_INT_SLOTS")
+            .map(|v| v != "0")
+            .unwrap_or(true)
+    })
+}
+
 /// The self-recursion stack guard (#381). **Default ON**; `TISH_JIT_RECUR_GUARD=0` disables it.
 ///
 /// A JIT'd self-recursive numeric function recurses on the native stack (SelfCall lowers to a native
@@ -477,6 +537,8 @@ struct JitGlobal {
     /// `FuncId` of the imported `tish_math_call` host fn (#186), declared once at module init and
     /// re-imported into each compiled function via `declare_func_in_func`.
     math_call_id: cranelift_module::FuncId,
+    /// `FuncId` of the imported `tish_math_binary_call` host fn (#203), for the `MathBinary` intrinsic.
+    math_binary_call_id: cranelift_module::FuncId,
     /// `FuncId`s of the imported `tish_jv_*` vector runtime (#189).
     jv_fns: JvFns,
     /// #187: directly-callable numeric callees, keyed by the stable global name a top-level function is
@@ -525,6 +587,15 @@ thread_local! {
     static JV_ARENA: std::cell::RefCell<JvArena> = const {
         std::cell::RefCell::new(JvArena { vecs: Vec::new(), free: Vec::new(), deopt: false })
     };
+    /// #203 — cache of `(chunk ptr, inner loop header) → (trig header, trig end, trig indexes arrays)`
+    /// for [`osr_expand_cached`]. The expansion analysis (a whole-chunk scan + per-candidate classify)
+    /// is loop-structure-only, so it is stable for a given chunk+header and computed ONCE here rather
+    /// than on every back-edge — critical for a small hot loop inside a function called millions of
+    /// times (e.g. nbody's `advance`), where recomputing per call is a real regression. A stale entry
+    /// (a freed chunk's address reused) can only mis-route a perf hint: `run_osr`/`compile_loop_region`
+    /// re-validate the region structurally + by fingerprint, so a wrong hint never miscompiles.
+    static OSR_EXPAND_CACHE: std::cell::RefCell<HashMap<(usize, usize), (usize, usize, bool, bool)>> =
+        std::cell::RefCell::new(HashMap::new());
 }
 /// `handle` (1-based, `0` = null) → arena index, or `None` for the null handle.
 #[cfg(not(target_arch = "wasm32"))]
@@ -667,9 +738,23 @@ extern "C" fn tish_math_call(id: i32, x: f64) -> f64 {
     }
 }
 
+/// #203 — host call for the `MathBinary` intrinsic (max/min/pow/atan2). Routes through
+/// `MathBinaryFn::apply`, the single source of truth, so JIT ≡ VM ≡ interp.
+extern "C" fn tish_math_binary_call(id: i32, a: f64, b: f64) -> f64 {
+    match tishlang_bytecode::MathBinaryFn::from_u16(id as u16) {
+        Some(m) => m.apply(a, b),
+        None => f64::NAN,
+    }
+}
+
 /// Build the JIT module and declare the imported host functions (`tish_math_call` #186, the
 /// `tish_jv_*` vector runtime #189), returning the module + their `FuncId`s.
-fn new_module() -> Option<(JITModule, cranelift_module::FuncId, JvFns)> {
+fn new_module() -> Option<(
+    JITModule,
+    cranelift_module::FuncId,
+    cranelift_module::FuncId,
+    JvFns,
+)> {
     let mut flag_builder = settings::builder();
     // JIT code is loaded at a fixed address; no PIC / colocated libcalls needed.
     flag_builder.set("use_colocated_libcalls", "false").ok()?;
@@ -681,6 +766,7 @@ fn new_module() -> Option<(JITModule, cranelift_module::FuncId, JvFns)> {
         .ok()?;
     let mut builder = JITBuilder::with_isa(isa, cranelift_module::default_libcall_names());
     builder.symbol("tish_math_call", tish_math_call as *const u8);
+    builder.symbol("tish_math_binary_call", tish_math_binary_call as *const u8);
     builder.symbol("tish_jv_new", tish_jv_new as *const u8);
     builder.symbol("tish_jv_push", tish_jv_push as *const u8);
     builder.symbol("tish_jv_get", tish_jv_get as *const u8);
@@ -699,6 +785,16 @@ fn new_module() -> Option<(JITModule, cranelift_module::FuncId, JvFns)> {
         .declare_function("tish_math_call", Linkage::Import, &msig)
         .ok()?;
 
+    // `tish_math_binary_call(i32 fn-id, f64 a, f64 b) -> f64` (#203).
+    let mut mbsig = module.make_signature();
+    mbsig.params.push(AbiParam::new(types::I32));
+    mbsig.params.push(AbiParam::new(types::F64));
+    mbsig.params.push(AbiParam::new(types::F64));
+    mbsig.returns.push(AbiParam::new(types::F64));
+    let math_binary_id = module
+        .declare_function("tish_math_binary_call", Linkage::Import, &mbsig)
+        .ok()?;
+
     // Helper to declare a `tish_jv_*` import from param/return abi lists.
     let mut declare = |name: &str, params: &[AbiParam], rets: &[AbiParam]| {
         let mut s = module.make_signature();
@@ -741,18 +837,19 @@ fn new_module() -> Option<(JITModule, cranelift_module::FuncId, JvFns)> {
         free: declare("tish_jv_free", &[AbiParam::new(types::I64)], &[])?,
         deopt: declare("tish_jv_deopt", &[], &[])?,
     };
-    Some((module, math_id, jv))
+    Some((module, math_id, math_binary_id, jv))
 }
 
 fn jit() -> Option<&'static Mutex<JitGlobal>> {
     JIT.get_or_init(|| {
-        new_module().map(|(module, math_call_id, jv_fns)| {
+        new_module().map(|(module, math_call_id, math_binary_call_id, jv_fns)| {
             Mutex::new(JitGlobal {
                 module,
                 cache: HashMap::new(),
                 osr_cache: HashMap::new(),
                 counter: 0,
                 math_call_id,
+                math_binary_call_id,
                 jv_fns,
                 callees: HashMap::new(),
             })
@@ -873,6 +970,121 @@ pub fn try_compile_numeric(chunk: &Chunk) -> Option<NumericFn> {
     result
 }
 
+/// #203 — expand a hot inner-loop region to the OUTERMOST enclosing loop that is itself array-OSR-
+/// compilable, so an array-indexing loop nest (matmul) marshals its arrays ONCE and runs the whole
+/// nest natively, instead of re-marshalling O(array) per inner-loop entry (a net wash). Returns the
+/// widest enclosing loop `(header, end)` whose region `classify_osr_arrays` accepts, or the input
+/// region if none encloses it. Only meaningful under `TISH_JIT_OSR_ARRAY`; the caller gates on the
+/// flag. SOUND to trigger at the returned loop's own back-edge: a `for` increment sits inside the
+/// region before the back-edge (so the live-in captures the *next* index) and inner loop vars are
+/// re-initialized by the body, so a native re-entry continues, never re-runs, completed iterations.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn osr_expand_region(chunk: &Chunk, header_ip: usize, region_end: usize) -> (usize, usize) {
+    let code = &chunk.code;
+    let mut best = (header_ip, region_end);
+    let mut ip = 0usize;
+    while ip < code.len() {
+        let op = match Opcode::from_u8(code[ip]) {
+            Some(o) => o,
+            None => break,
+        };
+        let size = match op.instruction_size(code, ip) {
+            Some(s) => s,
+            None => break,
+        };
+        if op == Opcode::JumpBack {
+            if let Some(dist) = peek_u16(code, ip + 1) {
+                let pos = ip + 3; // region_end convention: byte AFTER the JumpBack instruction
+                let tgt = pos.saturating_sub(dist as usize); // that loop's header
+                // A loop that STRICTLY encloses the input region (`tgt < header_ip` — starts before it —
+                // and `pos >= region_end`), and that ITSELF INDEXES ARRAYS, is worth expanding to: the
+                // whole point is to marshal its arrays once. Pick the WIDEST (smallest header). Keeping
+                // the header strictly smaller guarantees `best.0 == header_ip ⇒ best.1 == region_end`
+                // (no expansion), so the trigger's "sound entry" test stays exact.
+                let encloses = tgt < header_ip && pos >= region_end && tgt < best.0;
+                if encloses
+                    && classify_osr_arrays(chunk, tgt, pos).is_some_and(|a| !a.slots.is_empty())
+                {
+                    best = (tgt, pos);
+                }
+            }
+        }
+        ip += size;
+    }
+    best
+}
+
+/// #203 — does the OSR region `[header_ip, region_end)` index at least one array? Drives the OSR
+/// trigger cadence: an array-indexing (expandable) loop fires on the first sound entry past the
+/// threshold; a pure-numeric loop keeps the original threshold+retry-modulo sampling.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn osr_region_has_arrays(chunk: &Chunk, header_ip: usize, region_end: usize) -> bool {
+    classify_osr_arrays(chunk, header_ip, region_end).is_some_and(|a| !a.slots.is_empty())
+}
+
+/// #203 — is the region `[header_ip, region_end)` strictly enclosed by ANOTHER loop? An array region
+/// nested inside a non-array outer loop (e.g. k_nucleotide's `seq[i+j]` inner loop inside the Map-op
+/// outer loop) is re-entered per outer iteration, so array-OSR'ing it would re-marshal the whole array
+/// each entry — a net wash. Such regions are left to the interpreter (matching the flag-off path, where
+/// their `GetIndex` bails the numeric OSR anyway). Only an OUTERMOST array loop (matmul's `i` loop)
+/// marshals once and wins.
+#[cfg(not(target_arch = "wasm32"))]
+fn osr_region_enclosed(chunk: &Chunk, header_ip: usize, region_end: usize) -> bool {
+    let code = &chunk.code;
+    let mut ip = 0usize;
+    while ip < code.len() {
+        let op = match Opcode::from_u8(code[ip]) {
+            Some(o) => o,
+            None => break,
+        };
+        let size = match op.instruction_size(code, ip) {
+            Some(s) => s,
+            None => break,
+        };
+        if op == Opcode::JumpBack {
+            if let Some(dist) = peek_u16(code, ip + 1) {
+                let pos = ip + 3;
+                let tgt = pos.saturating_sub(dist as usize);
+                // strictly encloses on at least one side, contains on the other
+                if tgt <= header_ip && pos >= region_end && (tgt < header_ip || pos > region_end) {
+                    return true;
+                }
+            }
+        }
+        ip += size;
+    }
+    false
+}
+
+/// #203 — the OSR trigger decision for the loop at `header_ip`, memoized per `(chunk, header)` in a
+/// thread-local so the whole-chunk scans run at most once per loop header for the life of the thread
+/// (not once per enclosing-function call). Returns `(trig header, trig end, has_arrays, array_worthy)`:
+///   * `trig` = the outermost enclosing array loop to run instead (`== header_ip` if none);
+///   * `has_arrays` = the trig region indexes an array;
+///   * `array_worthy` = `has_arrays` AND the trig region is NOT itself nested in another loop — i.e.
+///     array-OSR'ing it marshals once and wins, rather than re-marshalling per outer iteration (a wash).
+/// The VM's `JumpBack` handler runs the array path only when `array_worthy`, gives up on a `has_arrays
+/// && !array_worthy` nested wash (interpret, matching flag-off), and takes the numeric path otherwise.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn osr_expand_cached(
+    chunk: &Chunk,
+    header_ip: usize,
+    region_end: usize,
+) -> (usize, usize, bool, bool) {
+    let key = (chunk as *const Chunk as usize, header_ip);
+    OSR_EXPAND_CACHE.with(|c| {
+        if let Some(&v) = c.borrow().get(&key) {
+            return v;
+        }
+        let (th, te) = osr_expand_region(chunk, header_ip, region_end);
+        let has_arrays = osr_region_has_arrays(chunk, th, te);
+        let array_worthy = has_arrays && !osr_region_enclosed(chunk, th, te);
+        let v = (th, te, has_arrays, array_worthy);
+        c.borrow_mut().insert(key, v);
+        v
+    })
+}
+
 /// Compile the hot loop region `[header_ip, region_end)` of `chunk` to native code (#190 OSR), or
 /// `None` if it is not a pure-numeric slot loop. Cached per `(chunk, header_ip)` with a fingerprint
 /// guard (negative results included, so a non-compilable loop is scanned once). Called from the frame
@@ -909,6 +1121,20 @@ fn compile_loop_region(
         return None;
     }
 
+    // #203 array-index (the matmul lever): behind `TISH_JIT_OSR_ARRAY`, classify the array live-in
+    // slots (`arr[i]` read / `arr[i]=v` write over a computed index). `None` ⇒ the region has array
+    // ops this pass can't lower ⇒ not compilable (its index ops keep bailing). `Some(empty)` ⇒ a
+    // pure-numeric region on the unchanged 2-pointer ABI. `Some(non-empty)` ⇒ the 3-pointer array ABI.
+    let arrays = if osr_array_enabled() {
+        classify_osr_arrays(chunk, header_ip, region_end)?
+    } else {
+        OsrArrays {
+            slots: Vec::new(),
+            writable: std::collections::BTreeSet::new(),
+        }
+    };
+    let array_set: std::collections::BTreeSet<u16> = arrays.slots.iter().copied().collect();
+
     // 1. Scan the region: validate the whitelist (op_size = None ⇒ bail), collect in-region block
     //    leaders, the live slot set, and the EXIT targets (jump targets outside the region). A
     //    JumpBack must stay inside the region (its own loop, possibly nested); one leaving the region
@@ -921,6 +1147,10 @@ fn compile_loop_region(
     while ip < region_end {
         let op = Opcode::from_u8(*code.get(ip)?)?;
         match op {
+            // #203: an `arr[i]` read / `arr[i]=v` write over a classified array slot — validated by
+            // `classify_osr_arrays`, lowered by the region body. `array_set` empty ⇒ these never appear
+            // (their base slot would have been classified an array), so the arm below can't fire.
+            Opcode::GetIndex | Opcode::SetIndex if !array_set.is_empty() => {}
             // Pure slot / stack / arithmetic / structured control flow — the region vocabulary.
             Opcode::Nop
             | Opcode::Pop
@@ -930,9 +1160,15 @@ fn compile_loop_region(
             | Opcode::LoopVarsEnd
             | Opcode::LoopVarsBegin
             | Opcode::UnaryOp
-            | Opcode::MathUnary => {} // #186 — `Math.<fn>(x)`: 1 f64 in, 1 f64 out (like UnaryOp)
+            | Opcode::MathUnary // #186 — `Math.<fn>(x)`: 1 f64 in, 1 f64 out (like UnaryOp)
+            | Opcode::MathBinary => {} // #203 — `Math.<fn>(a,b)`: 2 f64 in, 1 f64 out
             Opcode::LoadLocal | Opcode::StoreLocal => {
-                used.insert(peek_u16(code, ip + 1)?);
+                let s = peek_u16(code, ip + 1)?;
+                // #203: an array slot's live-in is a `Value::Array` marshalled through the handles
+                // buffer, NOT an f64 in the slots buffer — keep it out of the numeric live set.
+                if !array_set.contains(&s) {
+                    used.insert(s);
+                }
             }
             Opcode::LoadConst => match chunk.constants.get(peek_u16(code, ip + 1)? as usize) {
                 Some(Constant::Number(_)) | Some(Constant::Bool(_)) => {}
@@ -944,7 +1180,9 @@ fn compile_loop_region(
                     .map(|r| r as u8)
                     .and_then(u8_to_binop)?
                 {
-                    BinOp::And | BinOp::Or | BinOp::Pow | BinOp::In => return None,
+                    // #203: `**` (BinOp::Pow) IS lowerable now (a host call to `tish_math_binary_call`
+                    // in the region body), so it stays in the OSR whitelist. Logical/`in` still bail.
+                    BinOp::And | BinOp::Or | BinOp::In => return None,
                     _ => {}
                 }
             }
@@ -996,11 +1234,26 @@ fn compile_loop_region(
     let exits: Vec<usize> = exit_targets.iter().copied().collect();
     let exit_id: HashMap<usize, usize> = exits.iter().enumerate().map(|(i, &t)| (t, i)).collect();
 
-    // 2. Build the region function. Signature: (slots: i64 ptr, deopt: i64 ptr) -> i32 exit id.
+    // #203: array slot → its index in the handles buffer (marshalling order = ascending slot). Empty
+    // ⇒ the pure-numeric 2-pointer ABI (unchanged). The region body loads `(ptr,len)` from the handles
+    // buffer at `16 * array_pos[slot]` for each `arr[i]` access.
+    let has_arrays = !arrays.slots.is_empty();
+    let array_pos: HashMap<u16, usize> = arrays
+        .slots
+        .iter()
+        .enumerate()
+        .map(|(p, &s)| (s, p))
+        .collect();
+
+    // 2. Build the region function. Signature: `(slots, deopt) -> i32` (pure numeric) or
+    //    `(slots, handles, deopt) -> i32` (#203 array mode) — all pointers; returns the exit id.
     let ptr_ty = g.module.target_config().pointer_type();
     let mut sig = g.module.make_signature();
     sig.params.push(AbiParam::new(ptr_ty)); // slots buffer
-    sig.params.push(AbiParam::new(ptr_ty)); // deopt flag (reserved)
+    if has_arrays {
+        sig.params.push(AbiParam::new(ptr_ty)); // #203 handles buffer (ArrayHandle[])
+    }
+    sig.params.push(AbiParam::new(ptr_ty)); // deopt flag (int-slot miss #514 / OOB #203)
     sig.returns.push(AbiParam::new(types::I32));
 
     let name = format!("tish_osr_{}", g.counter);
@@ -1013,6 +1266,7 @@ fn compile_loop_region(
     let mut ctx = g.module.make_context();
     ctx.func.signature = sig.clone();
     let math_fref = g.module.declare_func_in_func(g.math_call_id, &mut ctx.func);
+    let math_binary_fref = g.module.declare_func_in_func(g.math_binary_call_id, &mut ctx.func);
     let mut fbctx = FunctionBuilderContext::new();
     let built = build_loop_region_body(
         &mut ctx.func,
@@ -1025,6 +1279,8 @@ fn compile_loop_region(
         &buf_pos,
         &exit_id,
         math_fref,
+        math_binary_fref,
+        &array_pos,
     );
     if !built {
         g.module.clear_context(&mut ctx);
@@ -1039,10 +1295,16 @@ fn compile_loop_region(
         return None;
     }
     let fptr = g.module.get_finalized_function(id);
+    let array_slots: Vec<(u16, bool)> = arrays
+        .slots
+        .iter()
+        .map(|&s| (s, arrays.writable.contains(&s)))
+        .collect();
     Some(LoopFn {
         ptr: fptr as usize,
         used_slots,
         exits,
+        array_slots,
     })
 }
 
@@ -1063,6 +1325,10 @@ fn build_loop_region_body(
     buf_pos: &HashMap<u16, usize>,
     exit_id: &HashMap<usize, usize>,
     math_fref: cranelift::codegen::ir::FuncRef,
+    math_binary_fref: cranelift::codegen::ir::FuncRef,
+    // #203: array slot → its index in the handles buffer (marshalling order). Empty ⇒ the pure-numeric
+    // 2-pointer ABI; non-empty ⇒ the 3-pointer array ABI `(slots, handles, deopt)`.
+    array_pos: &HashMap<u16, usize>,
 ) -> bool {
     let code = &chunk.code;
     let num_slots = chunk.num_slots as usize;
@@ -1081,28 +1347,137 @@ fn build_loop_region_body(
     bcx.append_block_params_for_function_params(entry);
     bcx.switch_to_block(entry);
     let params: Vec<ClifValue> = bcx.block_params(entry).to_vec();
-    let slots_ptr = params[0]; // params[1] = deopt flag, reserved (v1 never writes it)
+    let slots_ptr = params[0];
+    // #203: the array ABI inserts a `handles` pointer between `slots` and `deopt`. `deopt` is set on an
+    // int-slot live-in guard fail (#514) or an out-of-bounds array index (#203) → the VM re-interprets.
+    let (handles_ptr, deopt_ptr) = if array_pos.is_empty() {
+        (None, params[1])
+    } else {
+        (Some(params[1]), params[2])
+    };
+    // #203: load each array live-in's `(ptr, len)` ONCE at entry (loop-invariant; the entry block
+    // dominates the whole loop). `ArrayHandle` is `#[repr(C)] { ptr: *mut f64 @0, len: usize @8 }`,
+    // 16 bytes. `array_handles[slot] = (data_ptr, len_i64)`.
+    let ptr_ty = bcx.func.dfg.value_type(slots_ptr);
+    let mut array_handles: HashMap<u16, (ClifValue, ClifValue)> = HashMap::new();
+    if let Some(hptr) = handles_ptr {
+        for (&slot, &pos) in array_pos.iter() {
+            let base = (pos * 16) as i32;
+            let data = bcx.ins().load(ptr_ty, MemFlags::new(), hptr, base);
+            let len = bcx.ins().load(types::I64, MemFlags::new(), hptr, base + 8);
+            array_handles.insert(slot, (data, len));
+        }
+    }
+
+    // #514: port the fn-body int-typed slots (#511) into the OSR loop region. A slot whose every store
+    // is integer-typed lives in an `i64` Variable (`Repr::I64Num`), so an integer hash/PRNG accumulator
+    // stays in integer registers across the loop instead of an f64 materialize per store + ToInt32 per
+    // load. `arity` is 0 at top level (no params). `classify_int_slots` is chunk-level, so a slot that
+    // is int-stored in the region but f64-stored elsewhere in the chunk is (safely) NOT tagged.
+    let int_slots = classify_int_slots(chunk, 0);
     let vars: Vec<Variable> = (0..num_slots)
-        .map(|_| bcx.declare_var(types::F64))
+        .map(|slot| {
+            let ty = if int_slots.contains(&slot) {
+                types::I64
+            } else {
+                types::F64
+            };
+            bcx.declare_var(ty)
+        })
         .collect();
+
+    // Entry marshalling. A non-int slot loads its f64 live-in straight. An int slot's live-in arrives
+    // as f64 from the VM frame, so it must be an EXACT integer that round-trips through i64 — this
+    // rejects non-integers, NaN / ±Inf, out-of-i64-range, and -0 — or the `I64Num` invariant breaks.
+    // On any failure we set the deopt flag and return; the VM discards the (still-pristine) slots and
+    // re-interprets the loop. The guard runs once at region entry, off the per-iteration path.
+    let mut all_ok: Option<ClifValue> = None;
     for (slot, &var) in vars.iter().enumerate() {
-        // Live slots load from their buffer position; slots the region never touches init to 0 (dead).
-        let init = if let Some(&p) = buf_pos.get(&(slot as u16)) {
-            bcx.ins()
-                .load(types::F64, MemFlags::new(), slots_ptr, (p * 8) as i32)
+        let live: Option<ClifValue> = if let Some(&p) = buf_pos.get(&(slot as u16)) {
+            Some(
+                bcx.ins()
+                    .load(types::F64, MemFlags::new(), slots_ptr, (p * 8) as i32),
+            )
         } else {
-            bcx.ins().f64const(0.0)
+            None
         };
-        bcx.def_var(var, init);
+        if int_slots.contains(&slot) {
+            match live {
+                Some(x) => {
+                    let i64c = bcx.ins().fcvt_to_sint_sat(types::I64, x);
+                    let back = bcx.ins().fcvt_from_sint(types::F64, i64c);
+                    let exact = bcx.ins().fcmp(FloatCC::Equal, back, x);
+                    // -0 round-trips to +0 (IEEE `==` is true) but differs as an f64 read, so reject
+                    // it explicitly: 1/(-0) is -∞, 1/(+0) is +∞.
+                    let zero = bcx.ins().f64const(0.0);
+                    let is_zero = bcx.ins().fcmp(FloatCC::Equal, x, zero);
+                    let one = bcx.ins().f64const(1.0);
+                    let recip = bcx.ins().fdiv(one, x);
+                    let recip_neg = bcx.ins().fcmp(FloatCC::LessThan, recip, zero);
+                    let is_neg0 = bcx.ins().band(is_zero, recip_neg);
+                    let not_neg0 = bcx.ins().bxor_imm(is_neg0, 1);
+                    let ok = bcx.ins().band(exact, not_neg0);
+                    all_ok = Some(match all_ok {
+                        Some(a) => bcx.ins().band(a, ok),
+                        None => ok,
+                    });
+                    bcx.def_var(var, i64c);
+                }
+                None => {
+                    let z = bcx.ins().iconst(types::I64, 0);
+                    bcx.def_var(var, z);
+                }
+            }
+        } else {
+            let init = match live {
+                Some(x) => x,
+                None => bcx.ins().f64const(0.0),
+            };
+            bcx.def_var(var, init);
+        }
     }
     let header_block = match blocks.get(&header_ip) {
         Some(&b) => b,
         None => return false,
     };
-    bcx.ins().jump(header_block, &[]);
+    match all_ok {
+        // At least one int slot has a live-in: enter the loop only if every guard passed, else deopt.
+        Some(ok) => {
+            let deopt_block = bcx.create_block();
+            bcx.ins().brif(ok, header_block, &[], deopt_block, &[]);
+            bcx.switch_to_block(deopt_block);
+            let flag = bcx.ins().iconst(types::I8, 1);
+            bcx.ins().store(MemFlags::new(), flag, deopt_ptr, 0);
+            let zero_id = bcx.ins().iconst(types::I32, 0);
+            bcx.ins().return_(&[zero_id]);
+        }
+        None => {
+            bcx.ins().jump(header_block, &[]);
+        }
+    }
+
+    // #203: shared out-of-bounds pad — every array bounds-check that fails branches here, sets the
+    // deopt flag, and returns (exit id 0). The VM sees `deopt != 0` and re-interprets from the pristine
+    // pre-region state (the numeric buffer AND the array scratch are discarded, the real arrays are
+    // untouched), so a mid-region OOB never commits a partial result. Filled now; sealed at the end.
+    let array_deopt_block = if array_pos.is_empty() {
+        None
+    } else {
+        let b = bcx.create_block();
+        bcx.switch_to_block(b);
+        let flag = bcx.ins().iconst(types::I8, 1);
+        bcx.ins().store(MemFlags::new(), flag, deopt_ptr, 0);
+        let zero = bcx.ins().iconst(types::I32, 0);
+        bcx.ins().return_(&[zero]);
+        Some(b)
+    };
 
     // Translate the region. Operand stack is empty at every block boundary (statement-level flow).
-    let mut stack: Vec<(ClifValue, bool)> = Vec::new();
+    let mut stack: Vec<JV> = Vec::new();
+    // #203: array handles "in flight" — pushed by `LoadLocal(array slot)` as `(data_ptr, len)`, consumed
+    // by the very next `GetIndex`/`SetIndex`. Like `stack`, must be empty at every block boundary (an
+    // array access never spans a branch).
+    let mut arr_pending: Vec<(ClifValue, ClifValue)> = Vec::new();
     bcx.switch_to_block(header_block);
     let mut cur = header_block;
     let mut terminated = false;
@@ -1111,7 +1486,9 @@ fn build_loop_region_body(
         if let Some(&blk) = blocks.get(&ip) {
             if blk != cur {
                 if !terminated {
-                    if !stack.is_empty() {
+                    // #203: an operand OR a pending array handle spanning a block boundary is a shape
+                    // this straight-line-per-block emitter can't carry → bail (region interpreted).
+                    if !stack.is_empty() || !arr_pending.is_empty() {
                         return false;
                     }
                     bcx.ins().jump(blk, &[]);
@@ -1120,6 +1497,7 @@ fn build_loop_region_body(
                 cur = blk;
                 terminated = false;
                 stack.clear();
+                arr_pending.clear();
             }
         }
         let op = match Opcode::from_u8(code[ip]).zip(op_size_at(code, ip)) {
@@ -1139,11 +1517,25 @@ fn build_loop_region_body(
                     Some(s) => s as usize,
                     None => return false,
                 };
+                // #203: an array slot's "value" is its `(data_ptr, len)` handle — stage it OFF the
+                // numeric stack for the next `GetIndex`/`SetIndex` (matches build_body_cfg's jv_pending).
+                if let Some(&handle) = array_handles.get(&(slot as u16)) {
+                    arr_pending.push(handle);
+                    ip += 3;
+                    continue;
+                }
                 let v = match vars.get(slot) {
                     Some(v) => *v,
                     None => return false,
                 };
-                stack.push((bcx.use_var(v), false));
+                // #514: an int slot's `use_var` is an i64 carrying the exact number (`I64Num`);
+                // downstream int ops take it as identity, one exact convert at an f64 boundary.
+                let lv = bcx.use_var(v);
+                stack.push(if int_slots.contains(&slot) {
+                    JV::i64num(lv)
+                } else {
+                    JV::f64(lv)
+                });
                 ip += 3;
             }
             Opcode::StoreLocal => {
@@ -1151,18 +1543,38 @@ fn build_loop_region_body(
                     Some(s) => s as usize,
                     None => return false,
                 };
-                let (val, is_bool) = match stack.pop() {
+                let jval = match stack.pop() {
                     Some(x) => x,
                     None => return false,
                 };
-                if is_bool {
+                if jval.is_bool() {
                     return false; // no boolean slots (keeps the number/bool distinction clean)
                 }
                 let v = match vars.get(slot) {
                     Some(v) => *v,
                     None => return false,
                 };
-                bcx.def_var(v, val);
+                if int_slots.contains(&slot) {
+                    // #514/#168: store the EXACT number as i64 — I32 stores sign-extend, U32
+                    // zero-extend, I64Num is identity, an integral constant re-derives its exact
+                    // i64. Anything else means the optimistic pre-pass mis-tagged this slot (e.g. a
+                    // merge point whose linear predecessor differed) → bail; the VM keeps semantics.
+                    let iv = match jval.repr {
+                        Repr::I32 => bcx.ins().sextend(types::I64, jval.v),
+                        Repr::U32 => bcx.ins().uextend(types::I64, jval.v),
+                        Repr::I64Num => jval.v,
+                        Repr::F64 => match int_const_i64(&mut bcx, chunk, code, ip) {
+                            Some(iv) => iv,
+                            None => return false,
+                        },
+                        Repr::Bool => return false,
+                    };
+                    bcx.def_var(v, iv);
+                } else {
+                    // f64 Variable — one materialize at the store boundary.
+                    let val = jv_f64(&mut bcx, jval);
+                    bcx.def_var(v, val);
+                }
                 ip += 3;
             }
             Opcode::Pop => {
@@ -1223,13 +1635,14 @@ fn build_loop_region_body(
                     Some(o) => o as i16 as isize,
                     None => return false,
                 };
-                let (cond, _) = match stack.pop() {
+                let cond = match stack.pop() {
                     Some(x) => x,
                     None => return false,
                 };
                 if !stack.is_empty() {
                     return false;
                 }
+                let cond = jv_f64(&mut bcx, cond);
                 let falsy = falsy_flag(&mut bcx, cond);
                 let t = ((ip + 3) as isize + off).max(0) as usize;
                 let target = match target_block(t) {
@@ -1254,12 +1667,133 @@ fn build_loop_region_body(
                     Some(m) => m,
                     None => return false,
                 };
-                let (x, _) = match stack.pop() {
+                let x = match stack.pop() {
                     Some(v) => v,
                     None => return false,
                 };
+                let x = jv_f64(&mut bcx, x);
                 let r = emit_math_unary(&mut bcx, math_fref, mfn, x);
-                stack.push((r, false));
+                stack.push(JV::f64(r));
+                ip += 3;
+            }
+            // #203 — `arr[idx]` read. `arr`'s `(data,len)` handle is in `arr_pending`; the computed
+            // index is the f64 top of stack. `idx as usize` (saturating: NaN/neg → 0) matches the VM's
+            // coercion; an out-of-bounds index branches to the shared deopt pad (the VM re-interprets).
+            Opcode::GetIndex if !arr_pending.is_empty() => {
+                let (data, len) = match arr_pending.pop() {
+                    Some(h) => h,
+                    None => return false,
+                };
+                let idx = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let db = match array_deopt_block {
+                    Some(b) => b,
+                    None => return false,
+                };
+                let idx = jv_f64(&mut bcx, idx);
+                let i = bcx.ins().fcvt_to_uint_sat(types::I64, idx);
+                let inb = bcx.ins().icmp(IntCC::UnsignedLessThan, i, len);
+                let cont = bcx.create_block();
+                bcx.ins().brif(inb, cont, &[], db, &[]);
+                bcx.switch_to_block(cont);
+                cur = cont; // keep block-boundary tracking accurate after the mid-stream split
+                let off = bcx.ins().imul_imm(i, 8);
+                let addr = bcx.ins().iadd(data, off);
+                let val = bcx.ins().load(types::F64, MemFlags::new(), addr, 0);
+                stack.push(JV::f64(val));
+                ip += 1;
+            }
+            // #203 — `arr[idx] = v`. Stack: `[idx, val, dup_val]` (a `Dup` of `val` for the expression
+            // result); `arr`'s handle is in `arr_pending`. Store `dup_val` (== `val`) at the bounds-
+            // checked address; OOB → the deopt pad (scratch discarded, real array untouched).
+            Opcode::SetIndex if !arr_pending.is_empty() => {
+                let (data, len) = match arr_pending.pop() {
+                    Some(h) => h,
+                    None => return false,
+                };
+                let dup = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let _val = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let idx = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                // #203 SOUNDNESS: the region flattens every element to f64 and `run_osr` re-boxes the
+                // writeback as `Value::Number`. Storing a BOOLEAN (a comparison result `arr[i] = x>y`,
+                // a `LoadConst(Bool)`, or `!x`) would therefore land as `Number 1`/`0` where the
+                // interpreter stores `Bool true`/`false` — a divergence. There are no bool SLOTS in a
+                // region (StoreLocal bails on a bool), so a bool value is always this transient Repr::Bool
+                // — bail the whole region compile, let the interpreter handle the write.
+                if dup.is_bool() {
+                    return false;
+                }
+                let db = match array_deopt_block {
+                    Some(b) => b,
+                    None => return false,
+                };
+                let store_val = jv_f64(&mut bcx, dup);
+                let idx = jv_f64(&mut bcx, idx);
+                let i = bcx.ins().fcvt_to_uint_sat(types::I64, idx);
+                let inb = bcx.ins().icmp(IntCC::UnsignedLessThan, i, len);
+                let cont = bcx.create_block();
+                bcx.ins().brif(inb, cont, &[], db, &[]);
+                bcx.switch_to_block(cont);
+                cur = cont;
+                let off = bcx.ins().imul_imm(i, 8);
+                let addr = bcx.ins().iadd(data, off);
+                bcx.ins().store(MemFlags::new(), store_val, addr, 0);
+                stack.push(JV::f64(store_val)); // assignment yields the value
+                ip += 1;
+            }
+            Opcode::MathBinary => {
+                // #203 — `Math.<fn>(a, b)`: pop b, pop a, host-call, push. Every 2-arg Math fn routes
+                // through the host call (identical to the VM), so there are no native-op semantics to
+                // match — the win is skipping the boxed GetMember+value_call the generic path pays.
+                let id = match peek_u16(code, ip + 1) {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let b = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let a = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let b = jv_f64(&mut bcx, b);
+                let a = jv_f64(&mut bcx, a);
+                let idc = bcx.ins().iconst(types::I32, id as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, a, b]);
+                let r = bcx.inst_results(call)[0];
+                stack.push(JV::f64(r));
+                ip += 3;
+            }
+            _ if is_binop_pow(op, code, ip) => {
+                // #203: `a ** b` → host call to `tish_math_binary_call(Pow, a, b)` (== VM's `powf`).
+                let r = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let l = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let r = jv_f64(&mut bcx, r);
+                let l = jv_f64(&mut bcx, l);
+                let idc = bcx
+                    .ins()
+                    .iconst(types::I32, tishlang_bytecode::MathBinaryFn::Pow as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, l, r]);
+                let res = bcx.inst_results(call)[0];
+                stack.push(JV::f64(res));
                 ip += 3;
             }
             _ => match emit_simple_op(&mut bcx, chunk, code, &mut ip, &mut stack, &[], 0) {
@@ -1276,7 +1810,13 @@ fn build_loop_region_body(
     for (&t, &blk) in &exit_blocks {
         bcx.switch_to_block(blk);
         for (p, &slot) in used_slots.iter().enumerate() {
-            let v = bcx.use_var(vars[slot as usize]);
+            let raw = bcx.use_var(vars[slot as usize]);
+            // #514: an int slot holds an i64 — flush its exact f64 value back to the buffer.
+            let v = if int_slots.contains(&(slot as usize)) {
+                bcx.ins().fcvt_from_sint(types::F64, raw)
+            } else {
+                raw
+            };
             bcx.ins()
                 .store(MemFlags::new(), v, slots_ptr, (p * 8) as i32);
         }
@@ -1327,6 +1867,90 @@ fn fcmp_f64(bcx: &mut FunctionBuilder, cc: FloatCC, a: ClifValue, b: ClifValue)
     bcx.ins().select(cond, one, zero)
 }
 
+/// #168 — which Cranelift representation a JIT stack slot currently holds.
+///
+/// `F64`: an f64 number. `Bool`: an f64 constrained to 0.0/1.0 with JS-boolean semantics (the
+/// old `is_bool` flag — comparisons/`!` produce it, `LoadConst Bool` pushes it). `I32`: an i32
+/// holding `ToInt32` bits (signed→f64 on materialize). `U32`: an i32 holding `ToUint32` bits
+/// (UNSIGNED→f64 on materialize — `>>>` results past 2³¹ stay positive numbers).
+///
+/// The integer reprs are the point: a bitwise/shift chain (`h = ((h<<13)|(h>>>19)) >>> 0`) used
+/// to pay `int→f64→int` conversion ROUND-TRIPS between every op, because the stack could only
+/// say "f64 or bool". Now each such op consumes raw int bits via [`jv_i32_bits`] (an identity
+/// for `I32`/`U32`) and pushes an int repr; f64 materialization happens once, at a genuine
+/// boundary (store/return/float-arith/compare/call), via [`jv_f64`]. `ToInt32` and `ToUint32`
+/// share bit patterns, so `I32` vs `U32` only matters at the f64 boundary (signed vs unsigned
+/// convert) — the bits themselves are interchangeable as shift/bitwise inputs.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Repr {
+    F64,
+    Bool,
+    I32,
+    U32,
+    /// #168 int-typed slots: an i64 holding an EXACT integral JS number in [-2^31, 2^32).
+    /// Signedness is encoded in the value itself (an I32 store sign-extends, a U32 store
+    /// zero-extends, an integral constant loads exactly), so a slot whose stores mix `^`
+    /// (ToInt32 domain) and `>>> 0` (ToUint32 domain) needs no dynamic tag: materializing
+    /// is one exact `fcvt_from_sint`, and re-entering the 32-bit domain is one `ireduce`
+    /// (ToInt32 of an integral value in this range IS its low 32 bits).
+    I64Num,
+}
+
+/// A typed JIT stack value: the Cranelift SSA value plus its current [`Repr`].
+#[derive(Clone, Copy)]
+struct JV {
+    v: ClifValue,
+    repr: Repr,
+}
+
+impl JV {
+    fn f64(v: ClifValue) -> Self {
+        Self { v, repr: Repr::F64 }
+    }
+    fn boolean(v: ClifValue) -> Self {
+        Self { v, repr: Repr::Bool }
+    }
+    fn int32(v: ClifValue) -> Self {
+        Self { v, repr: Repr::I32 }
+    }
+    fn uint32(v: ClifValue) -> Self {
+        Self { v, repr: Repr::U32 }
+    }
+    fn is_bool(&self) -> bool {
+        self.repr == Repr::Bool
+    }
+}
+
+/// Materialize a [`JV`] as an f64 — identity for `F64`/`Bool` (a Bool already IS an f64 0/1),
+/// one signed/unsigned convert for the integer reprs.
+fn jv_f64(bcx: &mut FunctionBuilder, jv: JV) -> ClifValue {
+    match jv.repr {
+        Repr::F64 | Repr::Bool => jv.v,
+        Repr::I32 => bcx.ins().fcvt_from_sint(types::F64, jv.v),
+        Repr::U32 => bcx.ins().fcvt_from_uint(types::F64, jv.v),
+        // Exact by construction: an I64Num is integral and |v| < 2^32 << 2^53.
+        Repr::I64Num => bcx.ins().fcvt_from_sint(types::F64, jv.v),
+    }
+}
+
+/// Raw `ToInt32` bit pattern of a [`JV`] as an i32 — an identity (zero instructions) for
+/// `I32`/`U32` (they share bit patterns), [`js_to_int32`] for the f64 reprs (a Bool's 0.0/1.0
+/// converts to 0/1 exactly).
+fn jv_i32_bits(bcx: &mut FunctionBuilder, jv: JV) -> ClifValue {
+    match jv.repr {
+        Repr::I32 | Repr::U32 => jv.v,
+        Repr::F64 | Repr::Bool => js_to_int32(bcx, jv.v),
+        // ToInt32 of an exact integral in [-2^31, 2^32) is its low 32 bits.
+        Repr::I64Num => bcx.ins().ireduce(types::I32, jv.v),
+    }
+}
+
+impl JV {
+    fn i64num(v: ClifValue) -> Self {
+        Self { v, repr: Repr::I64Num }
+    }
+}
+
 /// f64 → JS `ToInt32` as an `I32` clif value, matching `tishlang_core::to_int32` (so a JIT-compiled
 /// `& | ^ ~` agrees with the VM fallback). Saturating-cast→`ireduce` is the modulo-2³² for finite
 /// values and already gives 0 for NaN / `-∞`; the branchless `select` on `|x| < ∞` maps `+∞` (which
@@ -1457,6 +2081,7 @@ fn compile_chunk(g: &mut JitGlobal, chunk: &Chunk) -> Option<NumericFn> {
     ctx.func.signature = sig.clone();
     let self_ref = g.module.declare_func_in_func(id, &mut ctx.func);
     let math_fref = g.module.declare_func_in_func(g.math_call_id, &mut ctx.func);
+    let math_binary_fref = g.module.declare_func_in_func(g.math_binary_call_id, &mut ctx.func);
     // #189: import the `tish_jv_*` FuncRefs into this function when it has local arrays.
     let jv_ctx = if is_jv {
         Some(JvCtx {
@@ -1485,6 +2110,7 @@ fn compile_chunk(g: &mut JitGlobal, chunk: &Chunk) -> Option<NumericFn> {
         0,
         recur_guard,
         math_fref,
+        math_binary_fref,
         jv_ctx.as_ref(),
         &resolved,
     ) {
@@ -1736,6 +2362,7 @@ fn compile_chunk_arrays(
     // `handles_ptr`/`deopt_ptr` — only the numeric args are re-marshalled per level.
     let self_ref = g.module.declare_func_in_func(id, &mut ctx.func);
     let math_fref = g.module.declare_func_in_func(g.math_call_id, &mut ctx.func);
+    let math_binary_fref = g.module.declare_func_in_func(g.math_binary_call_id, &mut ctx.func);
     // #187: array-mode functions (e.g. spectral_norm's multiplyAv) may call a register-f64 callee.
     let resolved = build_resolved_callees(g, chunk, &mut ctx.func);
     let mut fbctx = FunctionBuilderContext::new();
@@ -1749,6 +2376,7 @@ fn compile_chunk_arrays(
         mask,
         recursive, // #187: array-mode recursion guard (the entry SP-bail keys off this)
         math_fref,
+        math_binary_fref,
         None,
         &resolved,
     )
@@ -1800,7 +2428,7 @@ fn emit_simple_op(
     chunk: &Chunk,
     code: &[u8],
     ip: &mut usize,
-    stack: &mut Vec<(ClifValue, bool)>,
+    stack: &mut Vec<JV>,
     params: &[ClifValue],
     arity: usize,
 ) -> SimpleOp {
@@ -1825,7 +2453,7 @@ fn emit_simple_op(
             if slot >= arity {
                 return SimpleOp::Unsupported;
             }
-            stack.push((params[slot], false));
+            stack.push(JV::f64(params[slot]));
         }
         Opcode::LoadConst => {
             let idx = match read_u16(code, ip) {
@@ -1835,11 +2463,11 @@ fn emit_simple_op(
             match chunk.constants.get(idx) {
                 Some(Constant::Number(n)) => {
                     let v = bcx.ins().f64const(*n);
-                    stack.push((v, false));
+                    stack.push(JV::f64(v));
                 }
                 Some(Constant::Bool(b)) => {
                     let v = bcx.ins().f64const(if *b { 1.0 } else { 0.0 });
-                    stack.push((v, true));
+                    stack.push(JV::boolean(v));
                 }
                 _ => return SimpleOp::Unsupported,
             }
@@ -1852,121 +2480,143 @@ fn emit_simple_op(
             if stack.len() < 2 {
                 return SimpleOp::Unsupported;
             }
-            let (r, r_bool) = stack.pop().unwrap();
-            let (l, l_bool) = stack.pop().unwrap();
+            let r = stack.pop().unwrap();
+            let l = stack.pop().unwrap();
             // #187: a bool value (from a bool slot or a `LoadConst Bool`) can't take part in an
             // EQUALITY compare here — the JIT compares the `f64` 0/1 bits, but JS `===`/`!==` (and
             // strict `==`/`!=`) treat `0 === false` as FALSE across types. Bail so the interpreter
             // decides. Relational (`<`/`>`/…) coerces bool→0/1 in both, so those stay JIT'd.
+            // Integer reprs are plain NUMBERS, so they take part in every compare.
             let is_eq = matches!(
                 bop,
                 BinOp::Eq | BinOp::Ne | BinOp::StrictEq | BinOp::StrictNe
             );
-            if is_eq && (l_bool || r_bool) {
+            if is_eq && (l.is_bool() || r.is_bool()) {
                 return SimpleOp::Unsupported;
             }
-            let is_cmp = matches!(
-                bop,
-                BinOp::Eq
-                    | BinOp::Ne
-                    | BinOp::StrictEq
-                    | BinOp::StrictNe
-                    | BinOp::Lt
-                    | BinOp::Le
-                    | BinOp::Gt
-                    | BinOp::Ge
-            );
-            let v = match bop {
-                BinOp::Add => bcx.ins().fadd(l, r),
-                BinOp::Sub => bcx.ins().fsub(l, r),
-                BinOp::Mul => bcx.ins().fmul(l, r),
-                BinOp::Div => bcx.ins().fdiv(l, r),
-                BinOp::Eq | BinOp::StrictEq => fcmp_f64(bcx, FloatCC::Equal, l, r),
-                BinOp::Ne | BinOp::StrictNe => fcmp_f64(bcx, FloatCC::NotEqual, l, r),
-                BinOp::Lt => fcmp_f64(bcx, FloatCC::LessThan, l, r),
-                BinOp::Le => fcmp_f64(bcx, FloatCC::LessThanOrEqual, l, r),
-                BinOp::Gt => fcmp_f64(bcx, FloatCC::GreaterThan, l, r),
-                BinOp::Ge => fcmp_f64(bcx, FloatCC::GreaterThanOrEqual, l, r),
+            // #168: float arithmetic / comparisons materialize both operands as f64 at this
+            // boundary; bitwise/shift ops consume raw int bits (identity for I32/U32 operands)
+            // and PUSH an integer repr — a chained `((h<<13)|(h>>>19))>>>0` stays in i32
+            // registers with zero intermediate converts. `Mul` stays f64 ON PURPOSE: V8 rounds
+            // `h * K` past 2^53 the same way, and the gauntlet checksum pins that agreement.
+            let v: JV = match bop {
+                BinOp::Add => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::f64(bcx.ins().fadd(lf, rf))
+                }
+                BinOp::Sub => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::f64(bcx.ins().fsub(lf, rf))
+                }
+                BinOp::Mul => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::f64(bcx.ins().fmul(lf, rf))
+                }
+                BinOp::Div => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::f64(bcx.ins().fdiv(lf, rf))
+                }
+                BinOp::Eq | BinOp::StrictEq => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::Equal, lf, rf))
+                }
+                BinOp::Ne | BinOp::StrictNe => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::NotEqual, lf, rf))
+                }
+                BinOp::Lt => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::LessThan, lf, rf))
+                }
+                BinOp::Le => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::LessThanOrEqual, lf, rf))
+                }
+                BinOp::Gt => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::GreaterThan, lf, rf))
+                }
+                BinOp::Ge => {
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    JV::boolean(fcmp_f64(bcx, FloatCC::GreaterThanOrEqual, lf, rf))
+                }
                 BinOp::Mod => {
                     // f64 remainder a - trunc(a/b)*b — exactly Rust's `%`, which the
                     // VM's eval_binop uses, so JIT and VM-fallback agree bit-for-bit.
-                    let q = bcx.ins().fdiv(l, r);
+                    let (lf, rf) = (jv_f64(bcx, l), jv_f64(bcx, r));
+                    let q = bcx.ins().fdiv(lf, rf);
                     let t = bcx.ins().trunc(q);
-                    let p = bcx.ins().fmul(t, r);
-                    bcx.ins().fsub(l, p)
+                    let p = bcx.ins().fmul(t, rf);
+                    JV::f64(bcx.ins().fsub(lf, p))
                 }
-                // Bitwise AND/OR/XOR via JS ToInt32 (modulo 2³², NaN/±∞ → 0) — see [`js_to_int32`].
+                // Bitwise AND/OR/XOR via JS ToInt32 (modulo 2³², NaN/±∞ → 0) — [`jv_i32_bits`]
+                // is [`js_to_int32`] for f64 operands and an IDENTITY for int-repr operands.
                 BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor => {
-                    let li = js_to_int32(bcx, l);
-                    let ri = js_to_int32(bcx, r);
+                    let li = jv_i32_bits(bcx, l);
+                    let ri = jv_i32_bits(bcx, r);
                     let res = match bop {
                         BinOp::BitAnd => bcx.ins().band(li, ri),
                         BinOp::BitOr => bcx.ins().bor(li, ri),
                         BinOp::BitXor => bcx.ins().bxor(li, ri),
                         _ => unreachable!(),
                     };
-                    bcx.ins().fcvt_from_sint(types::F64, res)
-                }
-                // Shifts. JS masks the count to the low 5 bits (`& 31`); the low 5 bits of `ToInt32(r)`
-                // equal `ToUint32(r)`, so `js_to_int32(r)` carries the right amount. We mask explicitly
-                // (`& 31`) so correctness never depends on Cranelift's own amount-masking convention.
-                // `<<`/`>>` are signed-domain (ToInt32 → i32 → signed→f64); `>>>` is logical on the
-                // unsigned bits with an UNSIGNED→f64 convert (result may exceed 2³¹). Bit-for-bit with
-                // vm.rs `eval_binop`: Shl/Shr = `to_int32(l).wrapping_sh*(to_uint32(r))`,
-                // UShr = `to_uint32(l).wrapping_shr(to_uint32(r))`.
+                    JV::int32(res)
+                }
+                // Shifts. JS masks the count to the low 5 bits (`& 31`); the low 5 bits of
+                // `ToInt32(r)` equal `ToUint32(r)`, so `jv_i32_bits(r)` carries the right amount.
+                // We mask explicitly (`& 31`) so correctness never depends on Cranelift's own
+                // amount-masking convention. `<<`/`>>` are signed-domain (I32 repr — signed→f64
+                // when materialized); `>>>` is logical on the unsigned bits (U32 repr — an
+                // UNSIGNED→f64 materialize keeps a bit-31 result a positive number, JS `>>>`).
+                // Bit-for-bit with vm.rs `eval_binop`: Shl/Shr = `to_int32(l).wrapping_sh*
+                // (to_uint32(r))`, UShr = `to_uint32(l).wrapping_shr(to_uint32(r))`.
                 BinOp::Shl | BinOp::Shr | BinOp::UShr => {
-                    let li = js_to_int32(bcx, l);
-                    let amt = js_to_int32(bcx, r);
+                    let li = jv_i32_bits(bcx, l);
+                    let amt = jv_i32_bits(bcx, r);
                     let mask = bcx.ins().iconst(types::I32, 31);
                     let amt = bcx.ins().band(amt, mask);
                     match bop {
-                        BinOp::Shl => {
-                            let res = bcx.ins().ishl(li, amt);
-                            bcx.ins().fcvt_from_sint(types::F64, res)
-                        }
-                        BinOp::Shr => {
-                            let res = bcx.ins().sshr(li, amt);
-                            bcx.ins().fcvt_from_sint(types::F64, res)
-                        }
-                        // UShr: logical shift on the same 32-bit value bits as ToUint32(l), then
-                        // unsigned→f64 so a result with bit 31 set stays a positive number (JS `>>>`).
-                        _ => {
-                            let res = bcx.ins().ushr(li, amt);
-                            bcx.ins().fcvt_from_uint(types::F64, res)
-                        }
+                        BinOp::Shl => JV::int32(bcx.ins().ishl(li, amt)),
+                        BinOp::Shr => JV::int32(bcx.ins().sshr(li, amt)),
+                        _ => JV::uint32(bcx.ins().ushr(li, amt)),
                     }
                 }
                 // Pow/In/And/Or: fall back to the VM.
                 _ => return SimpleOp::Unsupported,
             };
-            stack.push((v, is_cmp));
+            stack.push(v);
         }
         Opcode::UnaryOp => {
             let uop = match read_u16(code, ip).map(|r| r as u8).and_then(u8_to_unaryop) {
                 Some(u) => u,
                 None => return SimpleOp::Unsupported,
             };
-            let (o, _) = match stack.pop() {
+            let o = match stack.pop() {
                 Some(x) => x,
                 None => return SimpleOp::Unsupported,
             };
-            let (v, is_bool) = match uop {
-                UnaryOp::Neg => (bcx.ins().fneg(o), false),
-                UnaryOp::Pos => (o, false),
+            let v: JV = match uop {
+                UnaryOp::Neg => {
+                    let of = jv_f64(bcx, o);
+                    JV::f64(bcx.ins().fneg(of))
+                }
+                UnaryOp::Pos => JV::f64(jv_f64(bcx, o)),
                 UnaryOp::Not => {
+                    let of = jv_f64(bcx, o);
                     let zero = bcx.ins().f64const(0.0);
-                    (fcmp_f64(bcx, FloatCC::Equal, o, zero), true)
+                    JV::boolean(fcmp_f64(bcx, FloatCC::Equal, of, zero))
                 }
-                // `~x` = `!ToInt32(x) as f64` — JS ToInt32 (modulo, NaN/±∞ → 0) via [`js_to_int32`],
-                // matching the VM so a JIT-compiled `~` can't diverge on large/non-finite values.
+                // `~x` = `!ToInt32(x)` — JS ToInt32 (modulo, NaN/±∞ → 0) via [`jv_i32_bits`]
+                // (identity for an int-repr operand), matching the VM so a JIT-compiled `~`
+                // can't diverge on large/non-finite values. Pushes I32 — a `~` chain stays
+                // in integer registers.
                 UnaryOp::BitNot => {
-                    let oi = js_to_int32(bcx, o);
-                    let res = bcx.ins().bnot(oi);
-                    (bcx.ins().fcvt_from_sint(types::F64, res), false)
+                    let oi = jv_i32_bits(bcx, o);
+                    JV::int32(bcx.ins().bnot(oi))
                 }
                 _ => return SimpleOp::Unsupported,
             };
-            stack.push((v, is_bool));
+            stack.push(v);
         }
         _ => unreachable!("guarded above"),
     }
@@ -1989,12 +2639,209 @@ fn falsy_flag(bcx: &mut FunctionBuilder, cond: ClifValue) -> ClifValue {
 /// branch, nested branches, calls, member/index, or mismatched `is_bool` all return `None` so the
 /// VM runs the chunk instead — purely additive. Returns `Some(result_is_bool)`.
 /// Byte size of an opcode the loop-JIT understands; `None` ⇒ unsupported (bail → VM).
+/// #203: is the op at `ip` a `BinOp` whose operator is `**` (Pow)? Lets the loop builders intercept
+/// `a ** b` and lower it to a `tish_math_binary_call(Pow, …)` host call before the generic
+/// `emit_simple_op` (which rejects Pow) would bail the function.
+fn is_binop_pow(op: Opcode, code: &[u8], ip: usize) -> bool {
+    op == Opcode::BinOp
+        && peek_u16(code, ip + 1).map(|r| r as u8).and_then(u8_to_binop) == Some(BinOp::Pow)
+}
+
+/// #203 branch-free ternary lowering in the LOOP builder. **Default ON**; `TISH_JIT_TERNARY=0` falls
+/// back to bailing the function (byte-identical, just interpreted). Additive: a non-matching shape or
+/// disabled flag simply doesn't take the fast path.
+fn jit_ternary_enabled() -> bool {
+    static ENABLED: OnceLock<bool> = OnceLock::new();
+    *ENABLED.get_or_init(|| {
+        std::env::var("TISH_JIT_TERNARY")
+            .map(|v| v != "0")
+            .unwrap_or(true)
+    })
+}
+
+/// #203: ops allowed inside a ternary ARM — pure, side-effect-free value producers the inline
+/// `select` can emit UNCONDITIONALLY (both arms run, then `select` picks). No control flow / calls /
+/// stores / member / index / array ops (which could have side effects or need a block).
+fn is_ternary_arm_op(op: Opcode) -> bool {
+    matches!(
+        op,
+        Opcode::LoadLocal
+            | Opcode::LoadConst
+            | Opcode::BinOp
+            | Opcode::UnaryOp
+            | Opcode::MathUnary
+            | Opcode::MathBinary
+    )
+}
+
+/// #203: if the `JumpIfFalse` at `jif_ip` begins a clean ternary `cond ? A : B` — a forward branch
+/// whose THEN arm is straight-line pure-value ops ending in a `Jump`, whose ELSE arm begins exactly
+/// where that `Jump` lands past and runs pure-value ops to a single merge — return the merge ip.
+/// Conservative: a nested branch in an arm, a back-edge, or any non-value op → `None`, and the caller
+/// leaves it to the block CFG (which bails) / VM. Sound for compiler-generated bytecode: nothing jumps
+/// INTO a ternary's arms, so treating the whole span as one inline unit never drops a CFG edge.
+fn ternary_span(code: &[u8], jif_ip: usize) -> Option<(usize, usize, usize)> {
+    if Opcode::from_u8(*code.get(jif_ip)?)? != Opcode::JumpIfFalse {
+        return None;
+    }
+    let off = peek_u16(code, jif_ip + 1)? as i16 as isize;
+    let else_target = ((jif_ip + 3) as isize + off).max(0) as usize;
+    // THEN arm: pure-value ops from jif+3 up to the trailing `Jump`.
+    let then_start = jif_ip + 3;
+    let mut tip = then_start;
+    loop {
+        let op = Opcode::from_u8(*code.get(tip)?)?;
+        if op == Opcode::Jump {
+            break;
+        }
+        if !is_ternary_arm_op(op) {
+            return None;
+        }
+        tip += op_size(op)?;
+    }
+    let then_end = tip; // at the trailing Jump
+    let joff = peek_u16(code, tip + 1)? as i16 as isize;
+    let else_start = tip + 3;
+    let merge = (else_start as isize + joff).max(0) as usize;
+    if else_target != else_start || merge <= else_start {
+        return None;
+    }
+    // ELSE arm: pure-value ops from else_start up to merge.
+    let mut eip = else_start;
+    while eip < merge {
+        let op = Opcode::from_u8(*code.get(eip)?)?;
+        if !is_ternary_arm_op(op) {
+            return None;
+        }
+        eip += op_size(op)?;
+    }
+    if eip != merge || then_end <= then_start {
+        return None; // else arm must land exactly on merge; then arm must be non-empty
+    }
+    Some((then_end, else_start, merge))
+}
+
+/// #203: emit one ternary ARM — the pure-value ops in `[start, end)` — in the `build_body_cfg` context
+/// (`LoadLocal` reads the slot's CURRENT SSA `Variable`, unlike `emit_simple_op`'s params-only path).
+/// Returns `false` (bail the whole compile) on any op not in the arm whitelist or a decode failure.
+/// Both arms are emitted unconditionally, so every op here is side-effect-free (`is_ternary_arm_op`).
+#[allow(clippy::too_many_arguments)]
+fn emit_ternary_arm(
+    bcx: &mut FunctionBuilder,
+    chunk: &Chunk,
+    code: &[u8],
+    start: usize,
+    end: usize,
+    stack: &mut Vec<JV>,
+    vars: &[Variable],
+    int_slots: &std::collections::HashSet<usize>,
+    bool_slots: &std::collections::HashSet<usize>,
+    math_fref: cranelift::codegen::ir::FuncRef,
+    math_binary_fref: cranelift::codegen::ir::FuncRef,
+) -> bool {
+    let mut ip = start;
+    while ip < end {
+        let op = match Opcode::from_u8(code[ip]) {
+            Some(o) => o,
+            None => return false,
+        };
+        match op {
+            Opcode::LoadLocal => {
+                let slot = match peek_u16(code, ip + 1) {
+                    Some(s) => s as usize,
+                    None => return false,
+                };
+                let v = match vars.get(slot) {
+                    Some(v) => *v,
+                    None => return false,
+                };
+                let lv = bcx.use_var(v);
+                stack.push(if bool_slots.contains(&slot) {
+                    JV::boolean(lv)
+                } else if int_slots.contains(&slot) {
+                    JV::i64num(lv)
+                } else {
+                    JV::f64(lv)
+                });
+                ip += 3;
+            }
+            Opcode::MathUnary => {
+                let id = match peek_u16(code, ip + 1) {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let mfn = match MathUnaryFn::from_u16(id) {
+                    Some(m) => m,
+                    None => return false,
+                };
+                let x = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let x = jv_f64(bcx, x);
+                let r = emit_math_unary(bcx, math_fref, mfn, x);
+                stack.push(JV::f64(r));
+                ip += 3;
+            }
+            Opcode::MathBinary => {
+                let id = match peek_u16(code, ip + 1) {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let b = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let a = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let b = jv_f64(bcx, b);
+                let a = jv_f64(bcx, a);
+                let idc = bcx.ins().iconst(types::I32, id as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, a, b]);
+                stack.push(JV::f64(bcx.inst_results(call)[0]));
+                ip += 3;
+            }
+            _ if is_binop_pow(op, code, ip) => {
+                let r = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let l = match stack.pop() {
+                    Some(v) => v,
+                    None => return false,
+                };
+                let r = jv_f64(bcx, r);
+                let l = jv_f64(bcx, l);
+                let idc = bcx
+                    .ins()
+                    .iconst(types::I32, tishlang_bytecode::MathBinaryFn::Pow as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, l, r]);
+                stack.push(JV::f64(bcx.inst_results(call)[0]));
+                ip += 3;
+            }
+            // LoadConst / BinOp / UnaryOp are param-free — `emit_simple_op` handles them (advancing a
+            // local ip copy). It only ever touches `stack`, not slots, for these.
+            Opcode::LoadConst | Opcode::BinOp | Opcode::UnaryOp => {
+                let mut sip = ip;
+                match emit_simple_op(bcx, chunk, code, &mut sip, stack, &[], 0) {
+                    SimpleOp::Handled(_) => ip = sip,
+                    _ => return false,
+                }
+            }
+            _ => return false,
+        }
+    }
+    true
+}
+
 fn op_size(op: Opcode) -> Option<usize> {
     use Opcode::*;
     Some(match op {
         Nop | Pop | Dup | Return | LoopVarsEnd | EnterBlock | ExitBlock | GetIndex | SetIndex => 1,
         LoadLocal | StoreLocal | LoadConst | BinOp | UnaryOp | Jump | JumpIfFalse | JumpBack
-        | LoopVarsBegin | SelfCall | MathUnary => 3,
+        | LoopVarsBegin | SelfCall | MathUnary | MathBinary => 3,
         _ => return None,
     })
 }
@@ -2123,6 +2970,217 @@ fn classify_bool_slots(chunk: &Chunk) -> std::collections::HashSet<usize> {
     set
 }
 
+/// #168: slots eligible for i64 int-typed storage ([`Repr::I64Num`]): every `StoreLocal` to the
+/// slot is IMMEDIATELY preceded (linearly — statement boundaries have empty stacks, and the
+/// ternary shape bails out of `build_body_cfg`, so the linear predecessor IS the value producer;
+/// same assumption [`classify_bool_slots`] rests on) by an op that pushes integer bits — a
+/// bitwise/shift `BinOp`, a `~` `UnaryOp`, or a `LoadConst` of an integral Number in
+/// [-2^31, 2^32) (excluding `-0`, whose sign an integer store would erase). Param slots are
+/// excluded (they arrive as arbitrary f64s through the ABI). Like `classify_bool_slots` this is
+/// an OPTIMISTIC tag: a merge point could make the linear predecessor differ from the dynamic
+/// one, so the StoreLocal translator re-checks the actual stored repr and BAILS compilation on
+/// any non-integer store to a tagged slot — misclassification runs the VM, never miscompiles.
+fn classify_int_slots(chunk: &Chunk, arity: usize) -> std::collections::HashSet<usize> {
+    if !jit_int_slots_enabled() {
+        return std::collections::HashSet::new();
+    }
+    let code = &chunk.code;
+    let mut int_stores: std::collections::HashSet<usize> = std::collections::HashSet::new();
+    let mut other_stores: std::collections::HashSet<usize> = std::collections::HashSet::new();
+    let mut ip = 0usize;
+    let mut prev_pushes_int = false;
+    while ip < code.len() {
+        let op = match Opcode::from_u8(code[ip]) {
+            Some(o) => o,
+            None => break,
+        };
+        let size = match op.instruction_size(code, ip) {
+            Some(s) => s,
+            None => break,
+        };
+        if op == Opcode::StoreLocal {
+            if let Some(s) = peek_u16(code, ip + 1) {
+                let slot = s as usize;
+                if prev_pushes_int && slot >= arity {
+                    int_stores.insert(slot);
+                } else {
+                    other_stores.insert(slot);
+                }
+            }
+        }
+        prev_pushes_int = match op {
+            Opcode::BinOp => matches!(
+                peek_u16(code, ip + 1)
+                    .map(|r| r as u8)
+                    .and_then(u8_to_binop),
+                Some(
+                    BinOp::BitAnd
+                        | BinOp::BitOr
+                        | BinOp::BitXor
+                        | BinOp::Shl
+                        | BinOp::Shr
+                        | BinOp::UShr
+                )
+            ),
+            Opcode::UnaryOp => matches!(
+                peek_u16(code, ip + 1)
+                    .map(|r| r as u8)
+                    .and_then(u8_to_unaryop),
+                Some(UnaryOp::BitNot)
+            ),
+            Opcode::LoadConst => matches!(
+                peek_u16(code, ip + 1).and_then(|i| chunk.constants.get(i as usize)),
+                Some(Constant::Number(n))
+                    if n.fract() == 0.0
+                        && *n >= -(2f64.powi(31))
+                        && *n < 2f64.powi(32)
+                        && n.to_bits() != (-0f64).to_bits()
+            ),
+            _ => false,
+        };
+        ip += size;
+    }
+    int_stores
+        .difference(&other_stores)
+        .copied()
+        .collect()
+}
+
+/// #203 — the array live-in slots of an OSR loop region (the matmul lever), with the written subset.
+#[cfg(not(target_arch = "wasm32"))]
+struct OsrArrays {
+    /// Array-holding slots in ascending slot order — the marshalling order of the handles buffer.
+    slots: Vec<u16>,
+    /// Subset of `slots` written via `SetIndex` (copied back only after a clean, non-deopt exit).
+    writable: std::collections::BTreeSet<u16>,
+}
+
+/// #203 — classify the array live-in slots of an OSR loop region `[header_ip, region_end)`. Abstract-
+/// interprets the region's operand stack to find every slot used PURELY as the base of an `arr[i]`
+/// read (`GetIndex`) or `arr[i] = v` write (`SetIndex`) with an arbitrary COMPUTED index (`a[i*N+k]`).
+///
+/// Returns `Some(arrays)` — possibly with an empty `slots` (a pure-numeric region: caller keeps the
+/// unchanged 2-pointer ABI) — when the region's array usage is fully lowerable; `None` when it holds a
+/// `GetIndex`/`SetIndex` the emitter can't handle: a non-slot / computed array BASE (`a[i][j]`), an
+/// array slot also used as a scalar or reassigned (`arr = …`), or an operand stack the linear abstract
+/// interp can't balance. `None` leaves the region non-OSR-compilable (its index ops still bail).
+///
+/// Imprecision is always SAFE — never a miscompile: a slot wrongly called an array fails the runtime
+/// `Value::Array` marshalling guard in `run_osr` (→ interpret); a slot wrongly NOT called an array
+/// leaves a `GetIndex`/`SetIndex` the region emitter rejects (→ region not compiled). Only correctly-
+/// classified, all-`Number`-element arrays are ever compiled.
+#[cfg(not(target_arch = "wasm32"))]
+fn classify_osr_arrays(chunk: &Chunk, header_ip: usize, region_end: usize) -> Option<OsrArrays> {
+    let code = &chunk.code;
+    // An abstract stack entry: `Ref(slot)` = a bare `LoadLocal(slot)` result untouched since; any other
+    // producer (const, arithmetic, a loaded element, …) is `Scalar`. An array base must be a `Ref`.
+    #[derive(Clone, Copy, PartialEq)]
+    enum Av {
+        Scalar,
+        Ref(u16),
+    }
+    let mut astack: Vec<Av> = Vec::new();
+    let mut array_slots: std::collections::BTreeSet<u16> = Default::default();
+    let mut writable: std::collections::BTreeSet<u16> = Default::default();
+    // Slots ever consumed as a scalar (arithmetic operand, index, store source, cond, …) or reassigned
+    // — an array slot must appear in NEITHER, else its live-in isn't a stable, index-only array handle.
+    let mut scalar_use: std::collections::BTreeSet<u16> = Default::default();
+    let mut stored: std::collections::BTreeSet<u16> = Default::default();
+    // Consume one operand; a bare `Ref(slot)` reaching a scalar position taints that slot.
+    let taint = |astack: &mut Vec<Av>, scalar_use: &mut std::collections::BTreeSet<u16>| -> Option<()> {
+        match astack.pop()? {
+            Av::Ref(s) => {
+                scalar_use.insert(s);
+            }
+            Av::Scalar => {}
+        }
+        Some(())
+    };
+    let mut ip = header_ip;
+    while ip < region_end {
+        let op = Opcode::from_u8(*code.get(ip)?)?;
+        let size = op_size(op)?; // whitelist-sized ops only; anything else ⇒ region not compilable
+        match op {
+            Opcode::LoadLocal => astack.push(Av::Ref(peek_u16(code, ip + 1)?)),
+            Opcode::LoadConst => astack.push(Av::Scalar),
+            Opcode::StoreLocal => {
+                stored.insert(peek_u16(code, ip + 1)?);
+                taint(&mut astack, &mut scalar_use)?; // the stored value
+            }
+            Opcode::Pop => {
+                astack.pop()?; // discarded — no taint (a bare pop doesn't "use" the slot)
+            }
+            Opcode::Dup => {
+                let top = *astack.last()?;
+                astack.push(top);
+            }
+            Opcode::Nop
+            | Opcode::EnterBlock
+            | Opcode::ExitBlock
+            | Opcode::LoopVarsEnd
+            | Opcode::LoopVarsBegin => {}
+            Opcode::UnaryOp | Opcode::MathUnary => {
+                taint(&mut astack, &mut scalar_use)?;
+                astack.push(Av::Scalar);
+            }
+            Opcode::BinOp | Opcode::MathBinary => {
+                taint(&mut astack, &mut scalar_use)?;
+                taint(&mut astack, &mut scalar_use)?;
+                astack.push(Av::Scalar);
+            }
+            Opcode::GetIndex => {
+                taint(&mut astack, &mut scalar_use)?; // index (a scalar use of whatever produced it)
+                match astack.pop()? {
+                    Av::Ref(s) => {
+                        array_slots.insert(s);
+                    }
+                    Av::Scalar => return None, // computed / nested array base (`a[i][j]`) — bail
+                }
+                astack.push(Av::Scalar); // the loaded element
+            }
+            Opcode::SetIndex => {
+                taint(&mut astack, &mut scalar_use)?; // dup_val
+                taint(&mut astack, &mut scalar_use)?; // val
+                taint(&mut astack, &mut scalar_use)?; // idx
+                match astack.pop()? {
+                    Av::Ref(s) => {
+                        array_slots.insert(s);
+                        writable.insert(s);
+                    }
+                    Av::Scalar => return None,
+                }
+                astack.push(Av::Scalar); // SetIndex leaves the assigned value
+            }
+            // A terminator ends the basic block: the region invariant makes the operand stack empty
+            // here (JumpIfFalse pops its cond first). Clearing keeps the abstract stack self-contained
+            // per block — array access never spans a branch, so this loses nothing we can lower.
+            Opcode::Jump | Opcode::JumpBack => astack.clear(),
+            Opcode::JumpIfFalse => {
+                taint(&mut astack, &mut scalar_use)?; // cond
+                astack.clear();
+            }
+            _ => return None, // an opcode outside the region vocabulary ⇒ not compilable
+        }
+        ip += size;
+    }
+    // An array slot used anywhere as a scalar, or reassigned, isn't a stable index-only handle ⇒ the
+    // whole region is not array-compilable (its index ops keep bailing).
+    if array_slots
+        .iter()
+        .any(|s| scalar_use.contains(s) || stored.contains(s))
+    {
+        return None;
+    }
+    // Cap the handle count (matmul uses 3); keep it small so the marshalling stays cheap.
+    if array_slots.len() > 8 {
+        return None;
+    }
+    Some(OsrArrays {
+        slots: array_slots.into_iter().collect(),
+        writable,
+    })
+}
+
 /// on any misuse of a JV ref (it reaching a numeric op, a return, a call arg, a block boundary, …),
 /// so a mis-shaped use never miscompiles — it just falls back to the interpreter.
 fn classify_jv_slots(chunk: &Chunk) -> Option<std::collections::HashSet<usize>> {
@@ -2181,17 +3239,53 @@ fn peek_u16(code: &[u8], off: usize) -> Option<u16> {
 /// `LoadConst(Number)` (→ an f64 const) — for the array read/write peepholes. `None` for any other
 /// opcode / a non-numeric const, which makes the caller bail. #187
 #[cfg(not(target_arch = "wasm32"))]
+/// #168: the exact i64 for a `StoreLocal` into an int slot whose value arrived as a plain F64
+/// push — the classifier-approved case is a linearly-preceding `LoadConst` of an integral
+/// Number in [-2^31, 2^32) (excluding `-0`). `store_ip` points AT the StoreLocal opcode; the
+/// cfg builder's empty-stack-at-block-boundary discipline guarantees the linear predecessor is
+/// the dynamic value producer. Any other shape → `None` → the caller bails the whole compile.
+fn int_const_i64(
+    bcx: &mut FunctionBuilder,
+    chunk: &Chunk,
+    code: &[u8],
+    store_ip: usize,
+) -> Option<ClifValue> {
+    let lc = store_ip.checked_sub(3)?;
+    if Opcode::from_u8(*code.get(lc)?)? != Opcode::LoadConst {
+        return None;
+    }
+    match chunk.constants.get(peek_u16(code, lc + 1)? as usize)? {
+        Constant::Number(n)
+            if n.fract() == 0.0
+                && *n >= -(2f64.powi(31))
+                && *n < 2f64.powi(32)
+                && n.to_bits() != (-0f64).to_bits() =>
+        {
+            Some(bcx.ins().iconst(types::I64, *n as i64))
+        }
+        _ => None,
+    }
+}
+
 fn read_simple_operand(
     bcx: &mut FunctionBuilder,
     code: &[u8],
     at: usize,
     chunk: &Chunk,
     vars: &[Variable],
+    int_slots: &std::collections::HashSet<usize>,
 ) -> Option<ClifValue> {
     match Opcode::from_u8(*code.get(at)?)? {
         Opcode::LoadLocal => {
             let s = peek_u16(code, at + 1)? as usize;
-            Some(bcx.use_var(*vars.get(s)?))
+            let v = bcx.use_var(*vars.get(s)?);
+            // #168: an int slot's Variable is i64 (exact number) — materialize to the f64 this
+            // fast path assumes. Without this, the i64 value would flow into f64 instructions
+            // and trip the cranelift verifier (a crash, not a bail).
+            if int_slots.contains(&s) {
+                return Some(bcx.ins().fcvt_from_sint(types::F64, v));
+            }
+            Some(v)
         }
         Opcode::LoadConst => {
             let ci = peek_u16(code, at + 1)? as usize;
@@ -2233,6 +3327,8 @@ fn build_body_cfg(
     recur_guard: bool,
     // #186: the imported `tish_math_call` host fn, for lowering `Math.<fn>` (`MathUnary`) intrinsics.
     math_fref: cranelift::codegen::ir::FuncRef,
+    // #203: the imported `tish_math_binary_call` host fn, for lowering `MathBinary` (max/min/pow/atan2).
+    math_binary_fref: cranelift::codegen::ir::FuncRef,
     // #189: `Some` when the function has local `f64` arrays — carries the `tish_jv_*` `FuncRef`s + the
     // JV slot set. Those slots become `i64` handle Variables and their array ops lower to `tish_jv_*`
     // calls; an out-of-bounds index sets the per-thread deopt flag the wrapper re-interprets on.
@@ -2248,6 +3344,7 @@ fn build_body_cfg(
     }
     // #187: slots that hold a boolean (represented as `f64` 0/1). A `LoadLocal` of one carries
     // `is_bool` so a diverging `bool === number` compare or a `return bool` bails to the interpreter.
+    let int_slots = classify_int_slots(chunk, arity);
     let bool_slots = if jit_bool_slots_enabled() {
         classify_bool_slots(chunk)
     } else {
@@ -2263,9 +3360,22 @@ fn build_body_cfg(
     leaders.insert(0);
     let mut has_loop = false;
     let mut has_self_call = false;
+    // #203: `JumpIfFalse` ip → (then_end, else_start, merge) for each clean ternary lowered inline.
+    let mut ternaries: HashMap<usize, (usize, usize, usize)> = HashMap::new();
     let mut ip = 0;
     while ip < code.len() {
         let op = Opcode::from_u8(code[ip])?;
+        // #203: a clean ternary `cond ? A : B` is lowered branch-free (an inline `select`), so record
+        // it and SKIP the whole span — none of its internal targets become block leaders (no orphan
+        // blocks). Plain-numeric functions only (no JV arrays / array-mode); `TISH_JIT_TERNARY=0` off.
+        if op == Opcode::JumpIfFalse && jit_ternary_enabled() && jv.is_none() && array_mask == 0 {
+            if let Some(span) = ternary_span(code, ip) {
+                let (_then_end, _else_start, merge) = span;
+                ternaries.insert(ip, span);
+                ip = merge;
+                continue;
+            }
+        }
         // For a JV function the array opcodes (NewArray/GetMember/GetIndex/SetIndex/Call) are valid
         // and must be sized via the full instruction table; the translate loop then validates each is
         // a real JV op (else it bails). Non-JV functions keep the strict `op_size` whitelist.
@@ -2358,11 +3468,12 @@ fn build_body_cfg(
     };
     let body_start = *blocks.get(&0)?; // `entry` normally; `body_block` when guarded
 
-    // 2. A Variable per slot, all defined at entry so every path defines them. A JV slot (#189) holds
-    //    an arena HANDLE (a `u64`, 0 = null) so its Variable is `i64`, not `f64`.
+    // 2. A Variable per slot, all defined at entry so every path defines them. A JV slot (#189)
+    //    holds an arena HANDLE (a `u64`, 0 = null) so its Variable is `i64`, not `f64`; an int
+    //    slot (#168) holds an exact integral JS number as `i64` ([`Repr::I64Num`]).
     let vars: Vec<Variable> = (0..num_slots)
         .map(|i| {
-            let ty = if jv.is_some_and(|j| j.slots.contains(&i)) {
+            let ty = if jv.is_some_and(|j| j.slots.contains(&i)) || int_slots.contains(&i) {
                 types::I64
             } else {
                 types::F64
@@ -2398,6 +3509,8 @@ fn build_body_cfg(
                     .load(types::F64, MemFlags::new(), numeric_ptr, numeric_i * 8);
                 numeric_i += 1;
                 v
+            } else if int_slots.contains(&slot) {
+                bcx.ins().iconst(types::I64, 0)
             } else {
                 bcx.ins().f64const(0.0)
             };
@@ -2415,6 +3528,8 @@ fn build_body_cfg(
             } else {
                 let init = if i < arity {
                     params[i]
+                } else if int_slots.contains(&i) {
+                    bcx.ins().iconst(types::I64, 0)
                 } else {
                     bcx.ins().f64const(0.0)
                 };
@@ -2424,7 +3539,7 @@ fn build_body_cfg(
     }
 
     // 3. Translate. The operand stack is empty at every block boundary (statement-level control flow).
-    let mut stack: Vec<(ClifValue, bool)> = Vec::new();
+    let mut stack: Vec<JV> = Vec::new();
     // #189: JV array handles "in flight" (pushed by `LoadLocal`/`NewArray` of a JV slot, consumed by
     // the very next `GetIndex`/`SetIndex`/`GetMember`), kept off the f64 `stack`; and a pending
     // `arr.push` awaiting its arg + `Call`. Both must be empty at every block boundary.
@@ -2509,13 +3624,16 @@ fn build_body_cfg(
                         ip += 3;
                         continue;
                     }
-                    let idx_f64 = read_simple_operand(&mut bcx, code, ip + 3, chunk, &vars)?;
+                    let idx_f64 =
+                        read_simple_operand(&mut bcx, code, ip + 3, chunk, &vars, &int_slots)?;
                     // i = idx as usize (saturating: NaN→0, neg→0 — matches the VM's `n as usize`).
                     let i = bcx.ins().fcvt_to_uint_sat(types::I64, idx_f64);
                     // Read `val` (write only) BEFORE the bounds-check split so its LoadLocal reads the
                     // slot's current SSA value in `cur`, not the fresh `cont` block.
                     let store_val = if is_write {
-                        Some(read_simple_operand(&mut bcx, code, ip + 6, chunk, &vars)?)
+                        Some(read_simple_operand(
+                            &mut bcx, code, ip + 6, chunk, &vars, &int_slots,
+                        )?)
                     } else {
                         None
                     };
@@ -2529,19 +3647,28 @@ fn build_body_cfg(
                     let addr = bcx.ins().iadd(aptr, off);
                     if let Some(val) = store_val {
                         bcx.ins().store(MemFlags::new(), val, addr, 0);
-                        stack.push((val, false)); // assignment yields the value (a Pop usually discards it)
+                        stack.push(JV::f64(val)); // assignment yields the value (a Pop usually discards it)
                         ip += 11; // LoadLocal(arr) + idx + val + Dup + SetIndex
                     } else {
                         let val = bcx.ins().load(types::F64, MemFlags::new(), addr, 0);
-                        stack.push((val, false));
+                        stack.push(JV::f64(val));
                         ip += 7; // LoadLocal(arr) + idx + GetIndex
                     }
                     continue;
                 }
                 let v = *vars.get(slot)?;
-                // #187: a bool slot's `f64` 0/1 value carries `is_bool` so downstream equality/return
-                // guards fire; a plain numeric slot pushes `false`.
-                stack.push((bcx.use_var(v), bool_slots.contains(&slot)));
+                // #187: a bool slot's `f64` 0/1 value carries the Bool repr so downstream
+                // equality/return guards fire; an int slot (#168) pushes its exact-i64 repr
+                // (identity into further int ops, one exact convert at an f64 boundary); a
+                // plain numeric slot pushes F64.
+                let lv = bcx.use_var(v);
+                stack.push(if bool_slots.contains(&slot) {
+                    JV::boolean(lv)
+                } else if int_slots.contains(&slot) {
+                    JV::i64num(lv)
+                } else {
+                    JV::f64(lv)
+                });
                 ip += 3;
             }
             Opcode::StoreLocal => {
@@ -2554,15 +3681,43 @@ fn build_body_cfg(
                     ip += 3;
                     continue;
                 }
-                let (val, is_bool) = stack.pop()?;
+                let jval = stack.pop()?;
                 // #187: a boolean value may be stored only into a slot the pre-pass tagged as a bool
                 // slot (represented as `f64` 0/1). Any other bool store → bail (keeps unknown shapes
                 // on the interpreter). A numeric store into a bool-tagged slot is fine — the slot is
-                // still an `f64`; its `LoadLocal`s just carry `is_bool` (conservatively).
-                if is_bool && !bool_slots.contains(&slot) {
+                // still an `f64`; its `LoadLocal`s just carry the Bool repr (conservatively).
+                if jval.is_bool() && !bool_slots.contains(&slot) {
                     return None;
                 }
                 let v = *vars.get(slot)?;
+                if int_slots.contains(&slot) {
+                    // #168: an int slot stores the EXACT number as i64 — sign-extend ToInt32
+                    // results, zero-extend ToUint32 results, integral constants load exactly.
+                    // Anything else reaching here means the optimistic pre-pass mis-tagged the
+                    // slot (e.g. a merge point whose linear predecessor differed) → bail the
+                    // whole compile; the VM keeps semantics.
+                    let iv = match jval.repr {
+                        Repr::I32 => bcx.ins().sextend(types::I64, jval.v),
+                        Repr::U32 => bcx.ins().uextend(types::I64, jval.v),
+                        Repr::I64Num => jval.v,
+                        Repr::F64 => {
+                            // The classifier only tags int-op/const-preceded stores, but a
+                            // constant reaches here as an F64 push — re-derive its exact i64
+                            // when it is one of the classifier-approved integral constants.
+                            match int_const_i64(&mut bcx, chunk, code, ip) {
+                                Some(iv) => iv,
+                                None => return None,
+                            }
+                        }
+                        Repr::Bool => return None,
+                    };
+                    bcx.def_var(v, iv);
+                    ip += 3;
+                    continue;
+                }
+                // Slots are f64 Variables — materialize an int repr once, at the store (an
+                // `h = ((h<<13)|(h>>>19))>>>0` chain pays exactly ONE convert here, not per op).
+                let val = jv_f64(&mut bcx, jval);
                 bcx.def_var(v, val);
                 ip += 3;
             }
@@ -2580,10 +3735,11 @@ fn build_body_cfg(
             Opcode::Nop | Opcode::EnterBlock | Opcode::ExitBlock | Opcode::LoopVarsEnd => ip += 1,
             Opcode::LoopVarsBegin => ip += 3,
             Opcode::Return => {
-                let (v, is_bool) = stack.pop()?;
-                if is_bool {
+                let ret = stack.pop()?;
+                if ret.is_bool() {
                     return None;
                 }
+                let v = jv_f64(&mut bcx, ret);
                 // #189: free every JV array (return its arena slot to the free list) before leaving
                 // the frame — handle 0 (a slot not yet allocated on this path) is a no-op. This is why
                 // JV arrays must never escape.
@@ -2617,12 +3773,73 @@ fn build_body_cfg(
                 terminated = true;
                 ip += 3;
             }
+            // #203: a clean ternary detected in the leader scan → branch-free `select`, INLINE (no
+            // blocks). The stack BELOW the cond stays untouched (both arms push/pop their one result
+            // on top of it), so no operand crosses a block boundary — this is the only reason
+            // build_body_cfg's empty-stack-at-boundary invariant is not violated.
+            Opcode::JumpIfFalse if ternaries.contains_key(&ip) => {
+                let (then_end, else_start, merge) = *ternaries.get(&ip).unwrap();
+                let cond = stack.pop()?;
+                let cond = jv_f64(&mut bcx, cond);
+                let base = stack.len();
+                // THEN arm: [ip+3, then_end) → exactly one value.
+                if !emit_ternary_arm(
+                    &mut bcx,
+                    chunk,
+                    code,
+                    ip + 3,
+                    then_end,
+                    &mut stack,
+                    &vars,
+                    &int_slots,
+                    &bool_slots,
+                    math_fref,
+                    math_binary_fref,
+                ) || stack.len() != base + 1
+                {
+                    return None;
+                }
+                let then_jv = stack.pop()?;
+                let then_v = jv_f64(&mut bcx, then_jv);
+                // ELSE arm: [else_start, merge) → exactly one value.
+                if !emit_ternary_arm(
+                    &mut bcx,
+                    chunk,
+                    code,
+                    else_start,
+                    merge,
+                    &mut stack,
+                    &vars,
+                    &int_slots,
+                    &bool_slots,
+                    math_fref,
+                    math_binary_fref,
+                ) || stack.len() != base + 1
+                {
+                    return None;
+                }
+                let else_jv = stack.pop()?;
+                let else_v = jv_f64(&mut bcx, else_jv);
+                // Both arms must agree Bool-vs-Number (one `result_bool` shape, like build_body).
+                if then_jv.is_bool() != else_jv.is_bool() {
+                    return None;
+                }
+                let falsy = falsy_flag(&mut bcx, cond);
+                let sel = bcx.ins().select(falsy, else_v, then_v);
+                stack.push(if then_jv.is_bool() {
+                    JV::boolean(sel)
+                } else {
+                    JV::f64(sel)
+                });
+                ip = merge;
+            }
             Opcode::JumpIfFalse => {
                 let off = peek_u16(code, ip + 1)? as i16 as isize;
-                let (cond, _) = stack.pop()?;
+                let cond = stack.pop()?;
                 if !stack.is_empty() {
                     return None; // non-empty stack ⇒ ternary shape ⇒ leave to build_body / VM
                 }
+                let cond = jv_f64(&mut bcx, cond);
                 let falsy = falsy_flag(&mut bcx, cond);
                 let target = *blocks.get(&(((ip + 3) as isize + off).max(0) as usize))?;
                 let fallthrough = *blocks.get(&(ip + 3))?;
@@ -2651,10 +3868,12 @@ fn build_body_cfg(
                     3, // 2^3 = 8-byte alignment for f64
                 ));
                 let arg_start = stack.len() - num_numeric;
-                for (j, (v, is_bool)) in stack.drain(arg_start..).enumerate() {
-                    if is_bool {
+                let args: Vec<JV> = stack.drain(arg_start..).collect();
+                for (j, jv) in args.into_iter().enumerate() {
+                    if jv.is_bool() {
                         return None; // a bool numeric arg doesn't match the f64 ABI
                     }
+                    let v = jv_f64(&mut bcx, jv);
                     bcx.ins().stack_store(v, slot, (j * 8) as i32);
                 }
                 let num_ptr = bcx.ins().stack_addr(types::I64, slot, 0);
@@ -2667,7 +3886,8 @@ fn build_body_cfg(
                     call_args.push(gp);
                 }
                 let call = bcx.ins().call(sref, &call_args);
-                stack.push((bcx.inst_results(call)[0], false));
+                let res = bcx.inst_results(call)[0];
+                stack.push(JV::f64(res));
                 ip += 3;
             }
             Opcode::SelfCall => {
@@ -2679,12 +3899,13 @@ fn build_body_cfg(
                     return None;
                 }
                 let arg_start = stack.len() - arity;
+                let args: Vec<JV> = stack.drain(arg_start..).collect();
                 let mut call_args = Vec::with_capacity(arity);
-                for (v, is_bool) in stack.drain(arg_start..) {
-                    if is_bool {
+                for jv in args {
+                    if jv.is_bool() {
                         return None; // boolean args don't match the f64 ABI
                     }
-                    call_args.push(v);
+                    call_args.push(jv_f64(&mut bcx, jv));
                 }
                 // #381: thread the RecurGuard pointer through the recursive call so every level
                 // re-checks the stack at its entry. Present iff this function was compiled guarded.
@@ -2693,16 +3914,30 @@ fn build_body_cfg(
                 }
                 let call = bcx.ins().call(sref, &call_args);
                 let result = bcx.inst_results(call)[0];
-                stack.push((result, false));
+                stack.push(JV::f64(result));
                 ip += 3;
             }
             Opcode::MathUnary => {
                 // #186 — `Math.<fn>(x)`: pop the arg, emit native op / host call, push the result.
                 let id = peek_u16(code, ip + 1)?;
                 let mfn = MathUnaryFn::from_u16(id)?;
-                let (x, _) = stack.pop()?;
+                let x = stack.pop()?;
+                let x = jv_f64(&mut bcx, x);
                 let r = emit_math_unary(&mut bcx, math_fref, mfn, x);
-                stack.push((r, false));
+                stack.push(JV::f64(r));
+                ip += 3;
+            }
+            Opcode::MathBinary => {
+                // #203 — `Math.<fn>(a, b)`: pop b, pop a, host-call, push.
+                let id = peek_u16(code, ip + 1)?;
+                let b = stack.pop()?;
+                let a = stack.pop()?;
+                let b = jv_f64(&mut bcx, b);
+                let a = jv_f64(&mut bcx, a);
+                let idc = bcx.ins().iconst(types::I32, id as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, a, b]);
+                let r = bcx.inst_results(call)[0];
+                stack.push(JV::f64(r));
                 ip += 3;
             }
             // #189 — local-array ops, only for JV functions (`jv` = `Some`). Each consumes the array
@@ -2719,25 +3954,29 @@ fn build_body_cfg(
             }
             Opcode::GetIndex if !jv_pending.is_empty() => {
                 let jvc = jv?;
-                let idx = stack.pop()?.0;
+                let idx = stack.pop()?;
+                let idx = jv_f64(&mut bcx, idx);
                 let handle = jv_pending.pop()?;
                 // `idx as usize` (saturating: NaN/neg → 0), matching the VM's index coercion. OOB sets
                 // the per-thread deopt flag inside `tish_jv_get` and returns NaN.
                 let i = bcx.ins().fcvt_to_uint_sat(types::I64, idx);
                 let call = bcx.ins().call(jvc.get, &[handle, i]);
-                stack.push((bcx.inst_results(call)[0], false));
+                let res = bcx.inst_results(call)[0];
+                stack.push(JV::f64(res));
                 ip += 1;
             }
             Opcode::SetIndex if !jv_pending.is_empty() => {
                 let jvc = jv?;
                 // Stack: [ (array→jv_pending), idx, val, dup_val ]. `Dup` left `dup_val` == `val`.
-                let dup_val = stack.pop()?.0;
-                let _val = stack.pop()?.0;
-                let idx = stack.pop()?.0;
+                let dup_jv = stack.pop()?;
+                let _val = stack.pop()?;
+                let idx = stack.pop()?;
+                let dup_val = jv_f64(&mut bcx, dup_jv);
+                let idx = jv_f64(&mut bcx, idx);
                 let handle = jv_pending.pop()?;
                 let i = bcx.ins().fcvt_to_uint_sat(types::I64, idx);
                 bcx.ins().call(jvc.set, &[handle, i, dup_val]); // OOB → deopt flag inside tish_jv_set
-                stack.push((dup_val, false)); // assignment yields the value
+                stack.push(JV::f64(dup_val)); // assignment yields the value
                 ip += 1;
             }
             Opcode::GetMember if !jv_pending.is_empty() => {
@@ -2748,7 +3987,8 @@ fn build_body_cfg(
                     "length" => {
                         let call = bcx.ins().call(jvc.len, &[ptr]);
                         let len_i = bcx.inst_results(call)[0];
-                        stack.push((bcx.ins().fcvt_from_uint(types::F64, len_i), false));
+                        let len_f = bcx.ins().fcvt_from_uint(types::F64, len_i);
+                        stack.push(JV::f64(len_f));
                     }
                     "push" => pending_push = Some(ptr),
                     _ => return None, // any other member of a JV array → bail
@@ -2761,12 +4001,14 @@ fn build_body_cfg(
                     return None; // `push` takes exactly one arg in the JV fast path
                 }
                 let ptr = pending_push.take()?;
-                let arg = stack.pop()?.0;
+                let arg = stack.pop()?;
+                let arg = jv_f64(&mut bcx, arg);
                 bcx.ins().call(jvc.push, &[ptr, arg]);
                 // `Array.push` returns the new length.
                 let call = bcx.ins().call(jvc.len, &[ptr]);
                 let len_i = bcx.inst_results(call)[0];
-                stack.push((bcx.ins().fcvt_from_uint(types::F64, len_i), false));
+                let len_f = bcx.ins().fcvt_from_uint(types::F64, len_i);
+                stack.push(JV::f64(len_f));
                 ip += 3;
             }
             // #187: `LoadVar name` where `name` is a resolved directly-callable callee — stage it for the
@@ -2792,15 +4034,17 @@ fn build_body_cfg(
                     return None;
                 }
                 let arg_start = stack.len() - callee_arity as usize;
+                let args: Vec<JV> = stack.drain(arg_start..).collect();
                 let mut call_args = Vec::with_capacity(callee_arity as usize);
-                for (v, is_bool) in stack.drain(arg_start..) {
-                    if is_bool {
+                for jv in args {
+                    if jv.is_bool() {
                         return None; // a bool arg doesn't match the callee's f64 ABI
                     }
-                    call_args.push(v);
+                    call_args.push(jv_f64(&mut bcx, jv));
                 }
                 let call = bcx.ins().call(fref, &call_args);
-                stack.push((bcx.inst_results(call)[0], false));
+                let res = bcx.inst_results(call)[0];
+                stack.push(JV::f64(res));
                 ip += 3;
             }
             // #187: a VOID array-mode function's implicit `return null` (the fall-through of a
@@ -2850,6 +4094,20 @@ fn build_body_cfg(
                 terminated = true; // the following `Return` (and any dead tail) is now skipped
                 ip += 3;
             }
+            _ if is_binop_pow(op, code, ip) => {
+                // #203: `a ** b` → host call to `tish_math_binary_call(Pow, a, b)` (== VM's `powf`).
+                let r = stack.pop()?;
+                let l = stack.pop()?;
+                let r = jv_f64(&mut bcx, r);
+                let l = jv_f64(&mut bcx, l);
+                let idc = bcx
+                    .ins()
+                    .iconst(types::I32, tishlang_bytecode::MathBinaryFn::Pow as i64);
+                let call = bcx.ins().call(math_binary_fref, &[idc, l, r]);
+                let res = bcx.inst_results(call)[0];
+                stack.push(JV::f64(res));
+                ip += 3;
+            }
             _ => match emit_simple_op(&mut bcx, chunk, code, &mut ip, &mut stack, &params, arity) {
                 SimpleOp::Handled(_) => {}
                 _ => return None, // LoadConst/BinOp/UnaryOp handled; anything else → VM
@@ -2888,9 +4146,10 @@ fn build_body(
     let params: Vec<ClifValue> = bcx.block_params(entry).to_vec();
 
     let code = &chunk.code;
-    // Each entry is (clif f64 value, is_bool). `is_bool` marks comparison/`!`
-    // results (logical 0.0/1.0) so the final value boxes as Bool, not Number.
-    let mut stack: Vec<(ClifValue, bool)> = Vec::new();
+    // Each entry is a typed [`JV`]. The Bool repr marks comparison/`!` results
+    // (logical 0.0/1.0) so the final value boxes as Bool, not Number; integer
+    // reprs materialize to f64 at the Return / select boundaries below.
+    let mut stack: Vec<JV> = Vec::new();
     let mut ip = 0usize;
     let mut result: Option<bool> = None;
 
@@ -2903,15 +4162,17 @@ fn build_body(
         let op = Opcode::from_u8(code[ip])?;
         match op {
             Opcode::Return => {
-                let (v, is_bool) = stack.pop()?;
+                let jv = stack.pop()?;
+                let v = jv_f64(&mut bcx, jv);
                 bcx.ins().return_(&[v]);
-                result = Some(is_bool); // first Return ends a (sub)path
+                result = Some(jv.is_bool()); // first Return ends a (sub)path
                 break;
             }
             // Ternary `cond ? A : B` → `select`. Both arms must be branch-free numeric
             // sub-sequences, each pushing exactly one value, with matching is_bool.
             Opcode::JumpIfFalse => {
-                let (cond, _) = stack.pop()?;
+                let cond = stack.pop()?;
+                let cond = jv_f64(&mut bcx, cond);
                 let mut p = ip + 1;
                 let off = read_u16(code, &mut p)? as i16 as isize; // p now past the operand
                 let else_target = (p as isize + off).max(0) as usize;
@@ -2938,7 +4199,8 @@ fn build_body(
                 if else_target != jp || stack.len() != base + 1 {
                     return None;
                 }
-                let (then_v, then_b) = stack.pop()?;
+                let then_jv = stack.pop()?;
+                let then_v = jv_f64(&mut bcx, then_jv);
 
                 // ELSE arm: straight-line ops from `jp` up to the merge point.
                 let mut eip = jp;
@@ -2953,15 +4215,20 @@ fn build_body(
                 if eip != merge_target || stack.len() != base + 1 {
                     return None;
                 }
-                let (else_v, else_b) = stack.pop()?;
+                let else_jv = stack.pop()?;
+                let else_v = jv_f64(&mut bcx, else_jv);
                 // One result_bool per function: arms must agree on Bool-vs-Number.
-                if then_b != else_b {
+                if then_jv.is_bool() != else_jv.is_bool() {
                     return None;
                 }
 
                 let falsy = falsy_flag(&mut bcx, cond);
                 let sel = bcx.ins().select(falsy, else_v, then_v);
-                stack.push((sel, then_b));
+                stack.push(if then_jv.is_bool() {
+                    JV::boolean(sel)
+                } else {
+                    JV::f64(sel)
+                });
                 ip = merge_target;
             }
             // #187: a `function name(x) { … }` block body wraps its statements in EnterBlock/ExitBlock
@@ -3602,7 +4869,7 @@ mod tests {
         assert!(!lf.used_slots.is_empty() && !lf.exits.is_empty());
         let mut buf = vec![0.0f64; lf.used_slots.len()];
         let mut deopt = 0u8;
-        let exit = lf.call(&mut buf, &mut deopt);
+        let exit = lf.call(&mut buf, &mut [], &mut deopt);
         assert!((exit as usize) < lf.exits.len(), "exit id in range");
         assert_eq!(deopt, 0, "v1 region never sets the deopt flag");
         let mut got = buf.clone();
@@ -3615,12 +4882,13 @@ mod tests {
     }
 
     /// #190 — a loop that touches a non-slot value (a general call) is not pure-numeric slot math, so
-    /// the region must be rejected (negative-cached) and the VM keeps interpreting. `Math.max` is a
-    /// 2-arg call (NOT the #186 unary intrinsic), so it stays a `Call` the region must reject.
+    /// the region must be rejected (negative-cached) and the VM keeps interpreting. A user-function
+    /// call is such a value. (`Math.max`/`min`/`pow` used to serve as the example here, but they are
+    /// now the #203 `MathBinary` intrinsic and DO OSR-compile — see `osr_region_handles_math_binary`.)
     #[test]
     fn osr_region_rejects_calls() {
         let chunk = top_chunk(
-            "let a = 0.0\nfor (let i = 0; i < 100; i = i + 1) { a = a + Math.max(i, 2.0) }\n",
+            "function g(x) { return x + 1.0 }\nlet a = 0.0\nfor (let i = 0; i < 100; i = i + 1) { a = a + g(i) }\n",
         );
         let (header, end) = first_region(&chunk);
         assert!(
@@ -3629,6 +4897,20 @@ mod tests {
         );
     }
 
+    /// #203 — a loop whose only "call" is a 2-arg `Math.<fn>` (the `MathBinary` intrinsic) IS
+    /// pure-numeric slot math, so the OSR region compiles it (the win for clamp/pow kernels).
+    #[test]
+    fn osr_region_handles_math_binary() {
+        let chunk = top_chunk(
+            "let a = 0.0\nfor (let i = 0; i < 100; i = i + 1) { a = a + Math.max(i, 2.0) }\n",
+        );
+        let (header, end) = first_region(&chunk);
+        assert!(
+            try_compile_loop(&chunk, header, end).is_some(),
+            "a loop with only a 2-arg Math intrinsic must OSR-compile"
+        );
+    }
+
     /// #190 — a loop with nested branches compiles and computes correctly through multiple blocks:
     /// `while (i < 20) { if (i % 2 == 0) s = s + i; i = i + 1 }` → s = sum of evens in 0..19 = 90.
     #[test]
@@ -3641,7 +4923,7 @@ mod tests {
             try_compile_loop(&chunk, header, end).expect("branchy numeric loop must OSR-compile");
         let mut buf = vec![0.0f64; lf.used_slots.len()];
         let mut deopt = 0u8;
-        lf.call(&mut buf, &mut deopt);
+        lf.call(&mut buf, &mut [], &mut deopt);
         let mut got = buf.clone();
         got.sort_by(|a, b| a.partial_cmp(b).unwrap());
         assert_eq!(got, vec![20.0, 90.0], "s=90 (0+2+…+18), i=20");